Open-source package vulnerability · NuGet
CVE-2026-24838: DotNetNuke.Core Vulnerable to Stored XSS via Module Title
criticalCVSS 3.1 9.1GHSA-w9pf-h6m6-v89h
Module title supports richtext which could include scripts that would execute in certain scenarios.
Published Jan 28, 2026
Affected packages
DotNetNuke.Core
- Ecosystem
- NuGet
- Affected
- < 9.13.10
- Fixed in
- 9.13.10
- Check
dotnet list package --include-transitive
DotNetNuke.Core
- Ecosystem
- NuGet
- Affected
- >= 10.0.0, < 10.2.0
- Fixed in
- 10.2.0
- Check
dotnet list package --include-transitive
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Module title supports richtext which could include scripts that would execute in certain scenarios.
Credited to bdukes.
References
- https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-w9pf-h6m6-v89h
- https://nvd.nist.gov/vuln/detail/CVE-2026-24838
- https://github.com/dnnsoftware/Dnn.Platform/commit/4a4bcbcdf3cedbf702816f8168c4d51bf688f7f6
- https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.0
- https://github.com/advisories/GHSA-w9pf-h6m6-v89h
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology