Stored Cross-Site Scripting Vulnerability in Optimizely Content Management System

CVE-2025-27800

What is CVE-2025-27800?

The Episerver Content Management System by Optimizely is susceptible to Stored Cross-Site Scripting vulnerabilities, which could allow an authenticated attacker to inject and execute malicious JavaScript code in the browser of victims. This is facilitated through the Admin dashboard's gadget feature, particularly the 'Notes' gadget. If an attacker with sufficient privileges, such as 'WebAdmin', impersonates a victim, they can embed harmful scripts in notes that will be executed upon the victim's visit to the dashboard. This presents a significant security risk to users and their data.

References