CVE-2020-36889 MEDIUM

CVE-2020-36889: Kentico Xperience <= 12.0.90 Administration Interface Stored XSS

Vendor Kentico

Product Xperience

Weakness CWE-79 · XSS

Published December 18, 2025

Last update December 30, 2025

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially crafted object names. This allows malicious scripts to execute in users' browsers when administrators view error messages in the administration interface.

Key dates

02Disclosure timeline

December 18, 2025 CVE published

December 30, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-36889 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-3321 SourceCodester eLearning System Maintenance Module cross site scripting CVE-2025-14144 Mstoic Shortcodes <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start' Shortcode Attribute CVE-2023-47525 WordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) CVE-2011-10039 Nagios XI < 2011R1.9 XSS via Alert Heatmap Report & “My Reports” Listing CVE-2023-44379 baserCMS Cross-site Scripting vulnerability in Site search Feature