CVE-2024-35239
Stored Cross-site Scripting on Components of Umbraco Forms
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Stored Cross-site Scripting on Components of Umbraco Forms
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
- Record
CVE-2024-35239- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-1704
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
- Record
EUVD-2024-1704- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p572-p2rj-q5f4
Umbraco Forms components vulnerable to Stored Cross-site Scripting
Impact
Authenticated user that has access to edit Forms may inject unsafe code into Forms components.
Patches
Issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
References
https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024 https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024 https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values
- Record
GHSA-p572-p2rj-q5f4- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
- Record
CVE-2024-35239- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-p572-p2rj-q5f4
Umbraco Forms components vulnerable to Stored Cross-site Scripting
Impact
Authenticated user that has access to edit Forms may inject unsafe code into Forms components.
Patches
Issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
References
https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024 https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024 https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values
- Record
GHSA-p572-p2rj-q5f4- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Umbraco.FormsNuGet |
13.0.0 up to 13.0.1 | 13.0.1 |
Umbraco.FormsNuGet |
12.0.0 up to 12.2.2 | 12.2.2 |
Umbraco.FormsNuGet |
10.0.0 up to 10.5.3 | 10.5.3 |
Umbraco.FormsNuGet |
8.0.0 up to 8.13.13 | 8.13.13 |
Umbraco.FormsNuGet |
12.0.0 up to 12.2.2, plus listed versions 12.1.012.1.0-rc112.1.112.1.212.2.012.2.0-rc112.2.1 |
12.2.2 |
Umbraco.FormsNuGet |
10.0.0 up to 10.5.3, plus listed versions 10.0.110.0.210.0.310.0.410.0.5 Show 22 moreShow less10.1.010.1.0-rc00110.1.110.1.210.1.310.2.010.2.0-rc00110.2.110.2.210.2.310.2.410.3.010.3.0-rc00110.3.110.3.210.3.310.4.010.4.0-rc110.5.010.5.0-rc110.5.110.5.2 |
10.5.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-35239 is a low vulnerability (CVSS 2.7) in Umbraco Forms, published May 28, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in Umbraco.Forms 13.0.1.
References
github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4
docs.umbraco.com/umbraco-forms/developer/configuration
nvd.nist.gov/vuln/detail/CVE-2024-35239