CVE-2025-27802

Vulnerability

CVE-2025-27802 is a stored cross-site scripting (XSS) vulnerability in Optimizely Episerver CMS. The root cause is insufficient sanitization of input within Rich Text Editor (RTE) properties—text fields used in the CMS 'Edit' section. An attacker with at least the 'WebEditor' role can submit arbitrary JavaScript code into these fields. When another user (such as an editor or administrator) visits the previewed page that renders the malicious content, the injected script executes in their browser [3].

Exploitation

The attack requires authentication and the 'WebEditor' role, but does not need any special network position beyond standard CMS access. The attacker interacts with the Edit interface, inserting malicious code into an RTE property. The malicious payload is stored on the server and subsequently served to any user who views the page's preview, without proper validation or encoding [1][3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser session. Depending on the user's privileges, this could lead to session hijacking, content manipulation, or lateral movement within the CMS. The vulnerability affects CMS instances using affected package versions: EPiServer.CMS.Core <11.21.4 with EPiServer.CMS.UI <11.37.5 (version 11.x), and EPiServer.CMS.Core <12.22.1 with EPiServer.CMS.UI <11.37.3 (version 12.x) [2][3].

Mitigation

The vendor released patched packages for all affected versions. For version 11.x, update to EPiServer.CMS.Core 11.21.4 and EPiServer.CMS.UI 11.37.5. For version 12.x, update to EPiServer.CMS.Core 12.22.1 and EPiServer.CMS.UI 11.37.3. Administrators should install these updates immediately [1][2][3].