Multiple stored Cross-Site Scripting (XSS) vulnerabilities were found in the Episerver Content Management System (CMS) by Optimizely. Authenticated attackers with appropriate access rights could inject malicious JavaScript code into the Admin dashboard's "Notes" gadget. This code would execute when a victim with access visited the dashboard, potentially compromising their session or data. The vulnerabilities affect versions prior to 11.21.4 of EPiServer.CMS.Core with EPiServer.CMS.UI prior to 11.37.5 in the 11.x line, and EPiServer.CMS.Core prior to 12.22.1 with EPiServer.CMS.UI prior to 11.37.3 in the 12.x line. The CVSS score is 4.8, indicating a medium severity risk.