high7.6
CVE-2026-24836
DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes
Impact
Extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | DotNetNuke.Core | >= 9.0.0, <= 9.13.9 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dnnsoftware | Dotnetnuke | from 9.0.0 before 9.13.10 from 10.0.0 before 10.2.0 |