Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 Umbraco, Stored XSS, #CVE-2026-31833 (Medium) https://dailycve.com/umbraco-stored-xss-cve-2026-31833-medium/
Post summary
The post merely references a CVE with its type and severity, indicating a disclosure of a stored XSS vulnerability, without further detail on PoCs, exploits, or mitigations.
CVE-2026-31833 Umbraco is an http://ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property t… https://www.cve.org/CVERecord?id=CVE-2026-31833
Post summary
CVE‑2026‑31833 permits authenticated backoffice users of certain Umbraco versions to inject malicious HTML into a CMS property.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | umbraco | umbraco_cms | - | - | - |