The vulnerability permits an attacker to store malicious JavaScript in the Scheduler LogNotes field of the DNN platform. When the notes are displayed in the PersonaBar interface, the script executes in the context of the logged‑in user, enabling arbitrary code execution, data exfiltration, or defacement. This stored cross‑site scripting (CWE‑79) carries a CVSS base score of 7.7, indicating a high impact if exploited.

Affected releases are DNN Platform versions 9.0.0 through 9.13.9 and all earlier 10.x releases prior to 10.2.0. The vendor issued a fix in version 9.13.10 and 10.2.0, which removes the ability to inject script into LogNotes.

The flaw requires the attacker to write a log note via the admin scheduler, so it is limited to users with sufficient privileges, typically administrators. The exploit probability, measured by EPSS, is below 1%, and the vulnerability is not currently listed in CISA’s KEV catalog. Nevertheless, because the execution context is syndicable, a privileged attacker can hijack sessions or perform phishing attacks within the CMS. The relatively low exploitation likelihood mitigates risk, but the potential impact remains significant for sites where scheduler notes are edited by trusted staff.