Kentico Xperience CVE-2025-5591

Exploitation requires that the target run Kentico Xperience 13 with a reachable form component (BizForm/online form) that accepts attacker-controlled input and later renders it to a privileged user. Injection itself is remote and unauthenticated (PR:N), but impact is realized only when a victim user - typically an administrator or content manager reviewing form submissions - opens the stored payload in their authenticated session (UI required). Limiting factors: the payload must survive any input sanitization, a privileged victim must view the malicious submission for session hijacking to succeed, and impact scales with the victim's privilege level rather than being automatic or wormable.

Signals are mixed and lean toward a moderate, not urgent, priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) with all impact metrics maxed (VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) yields 7.7, but those impact ratings appear inflated for a stored XSS: the described effect is session hijacking and acting in a victim's security context, which maps most naturally to confidentiality and integrity impact, not availability (VA:H is dubious for XSS). EPSS is very low at 0.03% (10th percentile), the flaw is NOT in CISA KEV, and no public exploit code is referenced - so this is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The E:U (Exploit Maturity: Unproven) in the vendor vector agrees with the low EPSS. The exploitability preconditions are real but modest: injection is unauthenticated (PR:N) via a public form component, but a privileged victim must actually view the malicious content (UI:P/UI:R), which gates impact. Net: a genuine, patchable stored-XSS weakness in an enterprise CMS that warrants remediation, but the absence of exploitation signals and the required victim interaction make it a routine-patch item rather than an emergency.

An unauthenticated attacker submits crafted input through a Kentico Xperience 13 form component, storing a malicious JavaScript payload. When an administrator or other privileged user later views that submission in the admin interface, the script executes in their browser session, letting the attacker hijack the session token and perform actions in the victim's security context. No public exploit code is referenced and exploitation requires the victim to open the poisoned content.