Critical DNN Platform Vulnerability Let Attackers Execute Malicious Scripts

A severe Stored Cross-Site Scripting (XSS) vulnerability in the Prompt module of the DNN Platform allows low-privilege, authenticated attackers to inject and execute arbitrary scripts in the context of privileged users, as described in the GitHub advisory designated CVE-2025-59545. Published as GHSA-2qxc-mf4x-wr29 by Daniel Valadas, the flaw affects all versions of the DotNetNuke[.]Core package prior to 10.1.0 and carries a CVSS v3.1 base score of 9.8 (Critical).

The Prompt module provides an interactive command-execution interface that returns raw HTML, and while most user input is sanitised, the stored input can be rendered untreated when a Prompt command is processed. An attacker can craft input containing embedded script tags and, when later retrieved for a Prompt command, the resulting HTML executes in the victim’s browser, potentially enabling data theft, session hijacking, or full administrative takeover.

Remediation requires upgrading DotNetNuke[.]Core to version 10.1.0 or later and redeploying, as well as implementing follow-on mitigations such as CSP and monitoring. According to GHSA-2qxc-mf4x-wr29.