CVE-2026-24836 — DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

CVE-2026-24836

DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes PUBLISHED

Description (CNA)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

Affected (CNA)

Vendor / product	Versions
dnnsoftware / Dnn.Platform	affected >= 9.0.0, < 9.13.10; affected >= 10.0.0, < 10.2.0

CWE

CWE-79

References

https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2g5g-hcgh-q3rp

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.