CVE-2014-100004: Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev.

Security readout for executives and security teams

This CVE describes a cross-site scripting issue in Sitecore CMS versions before 7.0 Update-4 rev. 140120. An attacker could inject web script or HTML through the xmlcontrol parameter. The source bundle does not provide CVSS scoring, broad affected-product metadata, or evidence of active exploitation. Exposure is most likely where legacy Sitecore CMS instances remain below 7.0 Update-4 rev. 140120, especially if reachable by untrusted users. The bundle does not identify additional affected products or versions. Treat this as a legacy-platform hygiene issue with moderate urgency. It is not listed in KEV and lacks confirmed exploitation evidence, but exposed outdated Sitecore systems can create business risk through browser-side compromise and session abuse. Mitigation focus: Upgrade affected Sitecore CMS instances to 7.0 Update-4 rev. 140120 or later.; Check current Sitecore vendor guidance for any superseding security updates.; Restrict public access to legacy Sitecore administrative or default endpoints where feasible..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.