CVE-2022-4979
Medium
Description
A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.
SeverityMedium
CVSS5.1
Exploit probability—
Product
Experience Platform
PublishedJul 25, 2025
First seenJul 25, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Sitecore Experience Platform | 7.5 Initial Release ≤ v ≤ 7.5 Update-2, 8.0 Initial Release ≤ v ≤ 8.0 Update-7, 8.1 Initial Release ≤ v ≤ 8.1 Update-3, 8.2 Initial Release ≤ v ≤ 8.2 Update-7, 9.0 Initial Release ≤ v ≤ 9.0 Update-2, 9.1 Initial Release ≤ v ≤ 9.1 Update 1, 9.2 Initial Release, 9.3 Initial Release, 10.0 Initial Release ≤ v ≤ 10.0 Update-3, 10.1 Initial Release ≤ v ≤ 10.1 Update-2, 10.2 Initial Release | — |
| Sitecore Content Mangement System (CMS) | 7.2 Initial Release ≤ v ≤ 7.2 Update-6 | — |
| Sitecore Managed Cloud | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.