CVE-2022-4979

Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS

MEDIUM

5.1

CVSS Score

Published: July 25, 2025 at 03:55 PM UTC

Updated: June 17, 2026 at 05:22 AM UTC

3 products affected across 1 vendorExperience PlatformManaged CloudCMS

Using Experience Platform by Sitecore?

Get instant alerts when new vulnerabilities affect Experience Platform - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.1

Exploit prediction

EPSS 0.7%

SSVC

No known exploit

Description

A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

CMS · Sitecore

95%

v ≤ update67.2 Initial Release ≤ v ≤ 7.2 Update-67.2 7.2 Initial Release

Experience Platform · Sitecore

95%

v ≤ update1v ≤ update2v ≤ update3v ≤ update710.0 Initial Release ≤ v ≤ 10.0 Update-310.1 Initial Release ≤ v ≤ 10.1 Update-27.5 Initial Release ≤ v ≤ 7.5 Update-28.0 Initial Release ≤ v ≤ 8.0 Update-78.1 Initial Release ≤ v ≤ 8.1 Update-38.2 Initial Release ≤ v ≤ 8.2 Update-79.0 Initial Release ≤ v ≤ 9.0 Update-29.1 Initial Release ≤ v ≤ 9.1 Update 110 10.0 Initial Release 10.1 10.1 Initial Release 10.2 10.2 Initial Release 7.5 7.5 Initial Release 8.0 8.0 Initial Release 8.1 8.1 Initial Release 8.2 8.2 Initial Release 9.0 9.0 Initial Release 9.1 9.1 Initial Release 9.2 9.2 Initial Release 9.3 9.3 Initial Release

Managed Cloud · Sitecore

95%

All versions