CVE-2026-24838 DotNetNuke.Core Vulnerable to Stored XSS via Module Title

Critical 9.1 Published 27 Jan 2026 Updated 28 Jan 2026

Attackers can inject malicious scripts into module titles, leading to stored XSS attacks against other users of the DNN platform.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-24838?

CVE-2026-24838 is a critical cross-site scripting vulnerability in Dnnsoftware Dotnetnuke, published on 27 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

Weakness: CWE-79

Which versions are affected by CVE-2026-24838?

4 open source packages ship an affected version, including DotNetNuke.Core. It affects 1 product.

Package	Affected	Fixed in
`DotNetNuke.Core` NuGet	All versions	`9.13.10`
`DotNetNuke.Core` NuGet	All versions	`9.13.10`
`DotNetNuke.Core` NuGet	From `10.0.0`	`10.2.0`
`DotNetNuke.Core` NuGet	From `10.0.0`	`10.2.0`

Products include Dnnsoftware Dotnetnuke.

How do I fix CVE-2026-24838?

Upgrade DotNetNuke.Core to a fixed version for your release line: 9.13.10 or 10.2.0.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-24838 being exploited?

There is no known exploitation of CVE-2026-24838 in the wild and no public exploit code.

All Dnnsoftware Dotnetnuke vulnerabilities

Sources

Also known as GHSA-w9pf-h6m6-v89h.