CVE-2025-59545: XSS in DotNetNuke.Core ≤9.9.1

The vulnerability lies within the Prompt module, which allows execution of commands that can return raw HTML. While the application generally sanitizes user-submitted data, the Prompt module's ability to treat command output as HTML creates a bypass. An attacker can craft malicious input containing embedded scripts or harmful markup. This malicious content, when processed, can be executed in the context of the user's browser, potentially leading to the theft of session cookies, redirection to phishing sites, or even the execution of arbitrary JavaScript code on the affected website. The blast radius extends to all users interacting with the Prompt module, particularly those with administrative privileges.

1. Reserved2025-09-17
2. Published2025-09-23
3. EPSS updated2026-03-23

The primary mitigation is to upgrade DotNetNuke.Core to version 10.1.0 or later, which includes the necessary fixes. If immediate upgrading is not feasible, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious input targeting the Prompt module. Specifically, look for patterns indicative of HTML injection attempts. Thoroughly review and sanitize all user-supplied data within the Prompt module, ensuring that any HTML output is properly encoded. Monitor DotNetNuke logs for suspicious activity related to the Prompt module, such as unusual command executions or unexpected HTML output.