CVE-2026-24838 CRITICAL

CVE-2026-24838: DotNetNuke.Core Vulnerable to Stored XSS via Module Title

Vendor Dnnsoftware
Product Dnn.Platform
Weakness CWE-79 · XSS
Published January 27, 2026
Last update January 28, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

Key dates

02Disclosure timeline

January 27, 2026 CVE published
January 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-24813 Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting CVE-2025-23689 WordPress Blogger Image Import plugin <= 2.1 - CSRF to Stored XSS vulnerability CVE-2025-23950 WordPress EZPlayer plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability CVE-2026-6399 General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter CVE-2024-3489 Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Expired Title