Product by Sitecore

    Sitecore Experience Platform

    22 known vulnerabilities in Sitecore Experience Platform (Sitecore), 3 of them actively exploited (CISA KEV).

    Key figures

    22

    Vulnerabilities

    3

    Actively exploited (KEV)

    1

    Used by ransomware

    6

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Sitecore Experience Platform (Sitecore)
    CriticalCVE-2021-42237

    Sitecore XP Remote Command Execution Vulnerability

    In CISA KEVRansomware

    		9.8
    CriticalCVE-2025-53690

    Sitecore Products ViewState Deserialization Vulnerability

    In CISA KEValso in 5 other products

    		9.0
    CriticalCVE-2019-9874

    Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

    In CISA KEValso in 1 other product

    		9.8
    CriticalCVE-2025-53693

    HTML Cache Poisoning through Unsafe Reflections

    also in 5 other products

    		9.8
    CriticalCVE-2023-35813

    Sitecore Experience Commerce: Remote Code Execution

    also in 3 other products

    		9.8
    HighCVE-2025-34511

    Sitecore PowerShell Extension RCE via Unrestricted Upload

    also in 3 other products

    		8.8
    HighCVE-2025-34510

    Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

    also in 3 other products

    		8.8
    HighCVE-2025-34509

    Sitecore XM and XP Hardcoded Credentials

    also in 3 other products

    		7.5
    HighCVE-2024-46938

    Sitecore Experience Commerce: security vulnerability

    also in 2 other products

    		7.5
    HighCVE-2025-53694

    Information Disclosure in ItemServices API

    also in 5 other products

    		7.5
    HighCVE-2019-11080

    Sitecore Experience Platform: Deserialization of Untrusted Data

    		8.8
    HighCVE-2023-33652

    Sitecore Experience Platform: Remote Code Execution

    		8.8
    HighCVE-2025-53691

    Sitecore Experience Remote Code Execution through Insecure Deserialization

    also in 5 other products

    		8.8
    CriticalCVE-2023-27068

    Sitecore Experience Platform: Deserialization of Untrusted Data

    		9.8
    HighCVE-2023-33653

    Sitecore Experience Platform: Remote Code Execution

    		8.8
    HighCVE-2023-27067

    Sitecore Experience Platform: Path Traversal

    		7.5
    HighCVE-2023-26262

    Sitecore Experience Manager: Code Execution

    also in 1 other product

    		7.2
    MediumCVE-2016-8855

    Sitecore Experience Platform: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2023-33651

    Sitecore Experience Commerce: security vulnerability

    also in 3 other products

    		7.5
    MediumCVE-2023-27066

    Sitecore Experience Platform: Path Traversal

    		6.5
    MediumCVE-2019-13493

    Sitecore Experience Platform: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2022-4979

    Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS

    		—

    All products by Sitecore