The vulnerability allows an attacker to embed crafted scripts into a module title via the richtext field, causing those scripts to execute when the page is viewed. This stored XSS can lead to client‑side code execution, potentially harvesting session data, defacing content, or redirecting users. The weakness is a classic input validation flaw as classified by CWE‑79.

The flaw affects the DNN Platform by dnnsoftware. Versions earlier than 9.13.10 in the 9.x branch and earlier than 10.2.0 in the 10.x branch are vulnerable. These releases are part of the open‑source DotNetNuke CMS.

The associated CVSS score of 9.1 indicates high severity, while the EPSS score of less than 1% suggests low likelihood of exploitation at the current time. The issue is not listed in CISA's KEV catalog, further indicating limited known exploitation. Likely attack surfaces involve users with permission to edit module titles; if such a user injects malicious code, any other user who visits the page will execute the payload. The vulnerability relies on storage and subsequent rendering of input, making it a persistent threat that can impact many users once deployed.