CVE-2015-5520: Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x befor...

Security readout for executives and security teams

CVE-2015-5520 is a stored cross-site scripting flaw in Orchard CMS. A remote user can place script or HTML in a username during account creation, and that content is mishandled when the account is deleted. The main business risk is compromise of staff browsing administrative user-management pages. Exposure is likely limited to organizations still running vulnerable Orchard CMS versions with the Users module and account creation workflow reachable by attackers or untrusted users. Treat this as a moderate-priority legacy web application issue. Prioritize internet-facing Orchard sites and sites allowing public registration, because successful exploitation could affect administrator sessions or content-management integrity. Mitigation focus: Upgrade Orchard CMS to 1.9.1 or later where feasible.; Apply the vendor Patch-20150630 guidance if upgrade is not immediately possible.; Restrict or moderate public account creation on affected Orchard sites..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.