Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore


Reported on

Jan 6th 2022


The application does not escape special characters before output to FE, lead to stored XSS.

Proof of Concept

Example of a case:

  1. Go to Content > Content Types /Admin/ContentTypes/List

  2. Create or edit a type with XSS payload into Display Name field, e.g: Social Meta Settings </title><svg/onload=alert('hacked')><title>

Tick on the Creatable checkbox

  1. Save and go to create new Type which edited above or go to Content > Content Items. Script will triggered


XSS can have huge implications for a web application and its users. User accounts can be hijacked, change the html screen and insult the organization. Credentials could be stolen, sensitive data could be exfiltrated, and lastly, access to your client computers can be obtained.

We are processing your report and will contact the orchardcms/orchardcore team within 24 hours. 22 days ago
We created a GitHub Issue asking the maintainers to create a 21 days ago
We have contacted a member of the orchardcms/orchardcore team and are waiting to hear back 20 days ago
orchardcms/orchardcore maintainer validated this vulnerability 18 days ago
laladee has been awarded the disclosure bounty
The fix bounty is now up for grabs
orchardcms/orchardcore maintainer confirmed that a fix has been merged on 4da927 17 days ago
The fix bounty has been dropped
Hello.cshtml#L25 has been validated
Index.cshtml#L54 has been validated
17 days ago


@maintainer your patch has not patched all locations. For example in the Workflows section, maybe I'll try to list them all in the next report