The Episerver Content Management System (CMS) by Optimizely contains multiple stored Cross-Site Scripting (XSS) vulnerabilities. Authenticated users with at least the WebEditor role could upload SVG files containing malicious JavaScript. This code executes when a user visits the direct URL of the preview image, potentially compromising user sessions or data. The vulnerabilities affect versions prior to 11.21.4 for EPiServer.CMS.Core with EPiServer.CMS.UI prior to 11.37.5, and versions prior to 12.22.1 for EPiServer.CMS.Core with EPiServer.CMS.UI prior to 11.37.3. The CVSS score is 4.8 (medium severity).