CVE-2023-48313: Umbraco CMS

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for this issue.

Affected products

• Umbraco Umbraco CMS: from 10.0.0, before 10.8.1 (fixed in 10.8.1); from 12.0.0, before 12.3.4 (fixed in 12.3.4)

Published 2023-12-12. Last modified 2026-06-17.