Advisories · Technology

Sitecore Experience Manager (XM).

Every CVE that names Sitecore Experience Manager (XM) among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-53692 CVE record

CVSS 7.1 High

Sitecore Experience Platform Cross-Site Scripting Vulnerability
- Sitecore Experience Manager (XM)
- Sitecore Experience Platform (XP)
- Cross-site scripting (XSS)
Not analysed yet 21 Sept 2025
CVE-2025-53690 CVE record

CVSS 9.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Sitecore Products ViewState Deserialization Vulnerability
- Sitecore Experience Manager (XM)
- Sitecore Experience Platform (XP)
- Insecure deserialization
Not analysed yet 3 Sept 2025
CVE-2025-53691 CVE record

CVSS 8.8 High

Sitecore Experience Remote Code Execution through Insecure Deserialization
- Sitecore Experience Manager (XM)
- Sitecore Experience Platform (XP)
- Insecure deserialization
Not analysed yet 3 Sept 2025
CVE-2025-53693 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

HTML Cache Poisoning through Unsafe Reflections
- Sitecore Experience Manager (XM)
- Sitecore Experience Platform (XP)
- Code injection
Not analysed yet 3 Sept 2025
CVE-2025-53694 CVE record

CVSS 7.5 High

Information Disclosure in ItemServices API
- Sitecore Experience Manager (XM)
- Sitecore Experience Platform (XP)
- Information disclosure
Not analysed yet 3 Sept 2025
CVE-2025-34139 CVE record

CVSS 8.7 High

Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read
- Sitecore Experience Manager (XM)
- Sitecore Experience Platform (XP)
- Hard-coded credentials
- Information disclosure
Not analysed yet 25 Jul 2025