A stored cross‑site scripting vulnerability exists in DNN (DotNetNuke) platform versions prior to 10.2.2. An attacker can upload a specially crafted SVG file that contains malicious scripts. When the file is later rendered to any user—authenticated or not—the browser executes the contained scripts in the context of the viewer’s session. The impact is higher when the victim is a privileged user.

The issue affects NetNuke by dnnsoftware that are running any version before 10.2.2. Any deployment that has not applied the 10.2.2 patch is vulnerable.

The CVSS score of 8.1 indicates high severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is uploading a malicious SVG file through the web interface; attackers with access to the upload functionality can embed scripts that later execute for all users who view the file.