← Vulnerability feed

Vulnerability record · CVE-2024-35239 · published 28 May 2024

CVE-2024-35239: Umbraco forms cross-site scripting vulnerability

Umbraco · Umbraco Forms

Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).

5.4 CVSS 3.1 Medium EPSS 0.34% · top 74.9% CWE-79 · Cross-site scripting
5.4CVSS 3.1 base score
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values Product
https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024 Release Notes
https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes Release Notes
https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024 Release Notes
https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4 Vendor Advisory
https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values Product
https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024 Release Notes
https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes Release Notes
https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024 Release Notes
https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4 Vendor Advisory

Track CVE-2024-35239 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-33224Umbraco forms unrestricted file upload vulnerabilityFile upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file.EPSS 0.73%7.5CVE-2025-68924Umbraco forms inclusion from untrusted sphere vulnerabilityIn Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code …EPSS 0.77%7.5CVE-2020-7685Umbraco forms insecure default initialization vulnerabilityThis affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file typ…EPSS 0.90%6.0CVE-2026-24687Umbraco forms path traversal vulnerabilityUmbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enu…EPSS 0.46%5.3CVE-2025-23041Umbraco forms improper input validation vulnerabilityUmbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are va…EPSS 0.38%2.3CVE-2025-47280Umbraco forms vulnerabilityUmbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 a…EPSS 0.29%6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed6.1CVE-2025-48700Zimbra Classic UI stored XSS via crafted email HTMLZimbra Collaboration Suite Classic UI fails to properly sanitize HTML content in email messages, allowing crafted tag structures and attribute values…KEVEPSS 1.7%analysed

Source: NIST National Vulnerability Database (record CVE-2024-35239), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.