Experience Platform (XP) vulnerabilities

6 known vulnerabilities in Experience Platform (XP) from Sitecore. 6 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  Sitecore Experience Manager (XM): Improper Neutralization of Input During Web Page Generation

  CVE-2025-53692Sep 21, 2025Sitecore

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cross-Site Scripting (XSS).This issue affects Sitecore Experience M

• 9.0 Critical severity

  Sitecore Multiple Products Deserialization of Untrusted Data Exploited

  CVE-2025-53690Sep 3, 2025SitecoreEPSS 60.7%

  Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

• 7.5 High severity

  Sitecore Experience Manager (XM): Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-53694Sep 3, 2025SitecoreEPSS 6.85%

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from

• 9.8 Critical severity

  Sitecore Experience Manager (XM): Use of Externally-Controlled Input to Select Classes or Code

  CVE-2025-53693Sep 3, 2025SitecoreEPSS 20.3%

  Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.

• 8.8 High severity

  Experience Manager (XM): Deserialization of Untrusted Data

  CVE-2025-53691Sep 3, 2025SitecoreEPSS 1.64%

  Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platf

• 8.7 High severity

  Experience Manager (XM): Insufficiently Protected Credentials

  CVE-2025-34139Jul 25, 2025Sitecore

  A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologie