Read the docs
TI-2025-20579 Aliases CVE-2025-27802GHSA-hwcj-2grf-hc24

Stored Cross-Site Scripting in Episerver Content Management System (CMS) Edit Preview

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. RTE properties (text fields), which could be used in the "Edit" section of the CMS, allowed the input of arbitrary text. It was possible to input malicious JavaScript code in these properties that would be executed if a user visits the previewed page. Attackers needed at least the role "WebEditor" in order to exploit this issue. Affected products: Version 11.X: EPiServer.CMS.Core (<11.21.4) with EPiServer.CMS.UI (<11.37.5), Version 12.X: EPiServer.CMS.Core (<12.22.1) with EPiServer.CMS.UI (<11.37.3)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00365 30th percentileScored 2026-11-07
Fix Fixed Episerver Content Management System (CMS) (Optimizely): 11.21.4, 12.22.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OptimizelyEpiserver Content Management System (CMS)11.x to before 11.21.4; 12.x to before 12.22.111.21.4, 12.22.1Patch availableCNA
  • Episerver Content Management System (CMS) VendorOptimizely Affected 11.x to before 11.21.4; 12.x to before 12.22.1 Fixed in 11.21.4, 12.22.1 Patch available CNA

Remediation

  • Fix · CNA Episerver Content Management System (CMS) (Optimizely) Fixed in 11.21.4, 12.22.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Optimizely Episerver Content Management System (CMS) 11.21.4, 12.22.1

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2025-20577 Stored Cross-Site Scripting in Episerver Content Management System (CMS) Admin DashboardPriority LOW 22
    • TI-2025-20578 Stored Cross-Site Scripting in Episerver Content Management System (CMS) Media Selection PreviewPriority LOW 21
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27802
  2. 2026-10-03 Alias added: GHSA-hwcj-2grf-hc24

References

Patch 2

Advisory 1

  • TI-2023-15203 Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8
  • TI-2025-16290 An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. CVSS 3.1HIGH 7.5
  • TI-2025-16287 An issue was discovered in Optimizely Configured Commerce before 5.2.2408. CVSS 3.1HIGH 7.5
  • TI-2025-16284 An issue was discovered in Optimizely Configured Commerce before 5.2.2408. CVSS 3.1HIGH 7.5
  • TI-2025-16289 An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. CVSS 3.1HIGH 8.0
  • TI-2024-37148 In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and… CVSS 3.1HIGH 8.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences