CVE-2020-37019mediumCWE-79

CVE-2020-37019: medium-severity vulnerability in Orchardcore Orchard Core

Orchard Core RC1 - Persistent Cross-Site Scripting

Published 30 Jan 2026 · Updated 23 Jun 2026

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.5%

Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation. Attackers can create blog posts with embedded JavaScript in the MarkdownBodyPart.Source parameter to execute arbitrary scripts in victim browsers.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Affected products

Orchardcore · Orchard Core

References

https://github.com/OrchardCMS/OrchardCore https://github.com/OrchardCMS/OrchardCore/issues/5802 https://www.exploit-db.com/exploits/48456 https://www.vulncheck.com/advisories/orchard-core-rc-persistent-cross-site-scripting http://www.orchardcore.net/