CVE-2026-24836
DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Record
CVE-2026-24836- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-4863
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Record
EUVD-2026-4863- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2g5g-hcgh-q3rp
DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes
Extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed.
- Record
GHSA-2g5g-hcgh-q3rp- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Record
CVE-2026-24836- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Record
CVE-2026-24836- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-2g5g-hcgh-q3rp
DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes
Extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed.
- Record
GHSA-2g5g-hcgh-q3rp- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
DotNetNuke.CoreNuGet |
9.0.0 to 9.13.9 | None known |
DotNetNuke.CoreNuGet |
10.0.0 up to 10.2.0 | 10.2.0 |
DotNetNuke.CoreNuGet |
9.0.0 to 9.13.9, plus listed versions 9.0.0.10029.0.1.1429.1.0.3679.1.1.1299.10.0 Show 37 moreShow less9.10.19.10.29.11.09.11.19.11.29.12.09.13.09.13.0-ci00009.13.19.13.29.13.39.13.49.13.59.13.5-ci00629.13.69.13.79.13.7-ci00649.13.89.2.0.3669.2.1.5339.3.09.3.19.3.29.4.09.4.19.4.29.4.39.4.49.5.09.6.19.6.29.7.09.7.19.7.29.8.09.9.09.9.1 |
None known |
DotNetNuke.CoreNuGet |
10.0.0 up to 10.02.0, plus listed versions 10.0.110.1.010.1.110.1.2 |
10.02.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-24836 is a high vulnerability (CVSS 7.7) in Dnnsoftware Dotnetnuke, published January 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in DotNetNuke.Core 10.2.0.