CVE-2026-24836
High · 7.6CVSS
7.6
EPSS
0.3%
Published
Jan 28, 2026
CISA due date
—
The record
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | DotNetNuke.Core | 10.0.0 | 10.02.0 |
| NuGet | DotNetNuke.Core | 9.0.0 | No fix |
| nuget | DotNetNuke.Core | 10.0.0 | 10.02.0 |
| nuget | DotNetNuke.Core | 9.0.0 | No fix |
Related vulnerabilities
- GHSA-2g5g-hcgh-q3rp DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes Same vulnerability
- GHSA-w9pf-h6m6-v89h DotNetNuke.Core Vulnerable to Stored XSS via Module Title Also affects DotNetNuke.Core
- GHSA-vm5q-8qww-h238 DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal Also affects DotNetNuke.Core
- GHSA-jjwg-4948-6wxp DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer Also affects DotNetNuke.Core
- CVE-2026-24838 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the… Also affects DotNetNuke.Core
- CVE-2026-24837 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the… Also affects DotNetNuke.Core
- CVE-2026-24784 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the… Also affects DotNetNuke.Core
- GHSA-hmvq-8p83-cq52 DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload Also affects DotNetNuke.Core