CVE-2025-24012: Umbraco CMS

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 contain a patch.

Affected products

• Umbraco Umbraco CMS: from 14.0.0, before 14.3.2 (fixed in 14.3.2); from 15.0.0, before 15.1.2 (fixed in 15.1.2)

Published 2025-01-21. Last modified 2026-06-17.