CVE-2022-4979: Sitecore Content Mangement System CMS

Medium severity, CVSS 5.1. EPSS: 0.6% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.

Affected products

• Sitecore Content Mangement System CMS: from 7.2 Initial Release, up to and including 7.2 Update-6
• Sitecore Experience Platform: from 7.5 Initial Release, up to and including 7.5 Update-2; from 8.0 Initial Release, up to and including 8.0 Update-7; from 8.1 Initial Release, up to and including 8.1 Update-3; from 8.2 Initial Release, up to and including 8.2 Update-7; from 9.0 Initial Release, up to and including 9.0 Update-2; from 9.1 Initial Release, up to and including 9.1 Update 1; …
• Sitecore Managed Cloud: any version

Published 2025-07-25. Last modified 2026-06-17.