# CVE-2025-5591: Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker…

Source: https://junglewise.ai/threats/cve-2025-5591-kentico-xperience-13-is-vulnerable-to-a-stored-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-05  
License: CC BY 4.0 with a link back

CVE-2025-5591 · Severity: medium · CVSS 5.4 · Published 2026-01-05

Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.

Technologies: [Kentico Xperience](https://junglewise.ai/threats/technologies/xperience). Vendors: [Kentico](https://junglewise.ai/threats/vendors/kentico).

## Quick answers

**Is CVE-2025-5591 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-5591 being exploited in the wild.

**How severe is CVE-2025-5591?** Medium severity, with a CVSS score of 5.4, published 5 January 2026.

**Which products and versions are affected?** Kentico Xperience. The advisory does not name versions.

**Is there a fix for CVE-2025-5591?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-5591?** Check whether you run Kentico Xperience. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Kentico Xperience

## Related threats

- [Kentico Xperience path traversal and RCE in Staging Sync Server](https://junglewise.ai/threats/cve-2025-2749-kentico-xperience-path-traversal-and-rce-in-staging-sync-server)
- [A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when…](https://junglewise.ai/threats/cve-2024-58317-a-cookie-security-configuration-vulnerability-in-kentico)
- [An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details…](https://junglewise.ai/threats/cve-2022-50686-an-information-disclosure-vulnerability-in-kentico-xperience)
- [A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious…](https://junglewise.ai/threats/cve-2022-50685-a-stored-cross-site-scripting-vulnerability-in-kentico-xperience)
- [An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form…](https://junglewise.ai/threats/cve-2022-50684-an-html-injection-vulnerability-in-kentico-xperience-allows)