CVE-2025-22388

MEDIUM

Optimizely CMS < 12.22.0 - Stored Cross-Site Scripting in Content Editing and Link Management

Title source: llm

Description

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or executing unauthorized actions. The issue exists in multiple areas, including content editing, link management, and file uploads.

References (1)

Core 1

Core References

Vendor Advisory

https://support.optimizely.com/hc/en-us/articles/33182047260557-Content-Management-System-CMS-Security-Advisory-CMS-2025-01

Scores

CVSS v3 5.7

EPSS 0.0032

EPSS Percentile 23.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

optimizely/optimizely_cms < 12.22.0

Published Jan 04, 2025

Tracked Since Feb 18, 2026