CVE-2022-50685

Medium · 5.4

CVSS

5.4

EPSS

0.2%

Published

Dec 18, 2025

CISA due date

—

The record

A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via XML file uploads as page attachments or metafiles. Attackers can upload malicious XML files that enable stored XSS, allowing malicious scripts to execute in users' browsers.

Affected packages

Ecosystem	Package	Introduced	Fixed