A permissive configuration in the UFM DOMPurify instance allowed event‑handler attributes such as onclick and onload to bypass sanitization. An authenticated back‑office user with access to Settings can inject malicious HTML into property‑type descriptions, enabling the execution of arbitrary JavaScript in users’ browsers when the affected CMS loads the web components (umb‑*, uui‑*, ufm‑*). This flaw falls under CWE‑79 and can compromise the confidentiality and integrity of data processed by the application, as well as the user experience for unsuspecting end users.

Affected systems include Umbraco CMS versions from 16.2.0 up to, but not including, 16.5.1. The vulnerability is not present in 17.2.2. The vulnerability is present in the UFM rendering pipeline and specifically impacts the attribute filtering of DOMPurify. Users should verify that their installed version is at least 16.5.1 or 17.2.2 to ensure the issue has been fixed.

The CVSS score for this vulnerability is 6.7, indicating a moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the general population. It is not listed in the CISA KEV catalog. The attack vector requires an authenticated user with back‑office Settings access, and the flaw can be exploited by injecting crafted HTML that preserves event‑handler attributes, leading to living cross‑site script attacks in the front‑end of the site.