Sitecore Experience Manager (XM) vulnerabilities

3 known vulnerabilities in Sitecore Experience Manager (XM) from Sitecore. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  Sitecore Experience Manager (XM): Improper Neutralization of Input During Web Page Generation

  CVE-2025-53692Sep 21, 2025Sitecore

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cross-Site Scripting (XSS).This issue affects Sitecore Experience M

• 7.5 High severity

  Sitecore Experience Manager (XM): Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-53694Sep 3, 2025SitecoreEPSS 6.85%

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from

• 9.8 Critical severity

  Sitecore Experience Manager (XM): Use of Externally-Controlled Input to Select Classes or Code

  CVE-2025-53693Sep 3, 2025SitecoreEPSS 20.3%

  Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.