CVE-2026-24838: XSS in DotNetNuke.Core ≤9.9.1

An attacker can leverage this XSS vulnerability to inject arbitrary JavaScript code into the module title field. When a user views the affected module, the injected script will execute within their browser context. This can lead to a variety of malicious outcomes, including session hijacking, redirection to phishing sites, and the theft of sensitive information like cookies and authentication tokens. The impact is particularly severe because module titles are often displayed prominently on websites, increasing the likelihood of user exposure. A successful attack could also allow an attacker to modify website content, leading to defacement or the dissemination of malware.

1. Reserved2026-01-27
2. Published2026-01-28
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24838 is to upgrade DotNetNuke.Core to version 9.13.10 or later. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious rich text content in module titles. Specifically, look for patterns indicative of JavaScript injection attempts. Additionally, carefully review and sanitize any user-supplied input used in module titles before rendering them on the website. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into a module title and verifying that it does not execute.