shouldiuse.io

Categories

VERDICT

Should I use Umbraco?

The flexible open-source .NET CMS - umbraco.com

Depends. Buy it if you have .NET developers and need a flexible, multi-site or headless CMS — the open-source core is free and battle-tested. Skip it if you want a simple no-code site or turnkey hosting; look at WordPress or Webflow, and be wary of Umbraco Cloud specifically.

Confidence

High. Based on 25+ public sources: G2, Reddit, NIST/GitHub advisories, Umbraco's own pages, and analyst listings.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free, open source

Umbraco CMS (self-hosted)

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Umbraco CloudSubscription, 4 tiers (exact prices not shown in sources)

Best for

  • .NET developer teams
  • Multi-site enterprises
  • Content-heavy marketing sites
  • Headless CMS projects

Not for

  • No-code marketers wanting a DIY site builder
  • Simple brochure or blog sites — massively overkill
  • Teams without .NET or Windows dev resources
  • Buyers wanting fuss-free managed hosting (Cloud backlash)

Gotchas - check before you buy

high

Reddit thread titled 'Umbraco Cloud – Avoid like the plague' targets the hosting, not the CMS

high

Umbraco Forms add-on had a high-severity path traversal vulnerability

medium

Cloud pricing changes yearly; 2026 increases already announced

medium

Outdated installs are a top breach vector; self-hosting means upgrades are on you

Pros and cons

Pros

  • Free, open-source .NET CMS with no license fees
  • G2 Winter 2026 Leader in CMS and Headless categories
  • Rated 4.5/5 across 1,032 G2 reviews
  • 731,438+ active websites, from charities to enterprises
  • Users report 15+ years of continuous production use

Cons

  • Needs .NET developers; not a no-code builder
  • Umbraco Cloud hosting draws harsh user criticism
  • Regular security advisories demand prompt patching
  • Key add-ons (Forms, Engage, AI) cost extra
  • Annual Cloud price increases announced for 2026

Sources & method

Analyzed 9/29/2026 - 14 sources - Actively patched open-source CMS with several published CVEs in 2025–2026; fixes ship via advisories.

official x6review x4security x3news x1
  • CVE-2026-46616: Open redirect in Umbraco CMS, Open redirect vulnerability disclosed in the SentinelOne vulnerability database.
  • CVE-2025-67288: Arbitrary file upload, Arbitrary file upload vulnerability tracked by NIST's NVD.
  • Umbraco Forms path traversal, Path traversal and file enumeration vulnerability in (GitHub advisory).
  • March 2026 advisory: three vulnerabilities, Moderate to high severity issues patched across Umbraco CMS; also an August 2026 patch release covering CMS, Forms, and AI.

Key stats

  • Value for money: 5/5

    Rating

  • Free, open source

    Starting price

  • 14

    Sources

  • Analyzed

  • Value for money: 5/5. Free open-source core; Cloud costs optional
  • Ease of use: 4/5. Friendly editor reputation; needs .NET developers
  • Feature depth: 5/5. CMS, headless, Forms, Engage; G2 Leader
  • Support quality: 3/5. Paid support sold; Cloud complaints on Reddit
  • Security posture: 3/5. Multiple 2025–26 CVEs; patched promptly
  • 4.5/5 G2 rating ~1,032 reviews
  • 731,438+ Active websites Per Umbraco's own figures
  • Free Self-hosted core Open-source .NET CMS
  • 4 tiers Umbraco Cloud Subscription plans; 2026 price rises announced

Pricing

Umbraco CMS (self-hosted)

Free, open source

  • Full CMS features
  • You manage hosting and upgrades

Umbraco Cloud

Subscription, 4 tiers (exact prices not shown in sources)

  • Managed cloud hosting
  • 2026 price increases announced

Security

Actively patched open-source CMS with several published CVEs in 2025–2026; fixes ship via advisories.

  • CVE-2026-46616: Open redirect in Umbraco CMSOpen redirect vulnerability disclosed in the SentinelOne vulnerability database.⁷
  • CVE-2025-67288: Arbitrary file uploadArbitrary file upload vulnerability tracked by NIST's NVD.⁶
  • Umbraco Forms path traversalPath traversal and file enumeration vulnerability in (GitHub advisory).⁸
  • March 2026 advisory: three vulnerabilitiesModerate to high severity issues patched across Umbraco CMS; also an August 2026 patch release covering CMS, Forms, and AI.

Alternatives

Compare Umbraco with each alternative.

  • Webflow

    No-code visual builder for teams without developers.

Companies that use it

  • Tesco12
  • ArcelorMittal12
  • Renault13
  • Thurgood Marshall Institute
  • Education Review Office
Full analysis

Based on 25+ public sources: G2, Reddit, NIST/GitHub advisories, Umbraco's own pages, and analyst listings.

Free, powerful .NET CMS for developer-led teams; overkill for simple sites, and Cloud hosting polarizes users.

Methodology

Based on 25+ public sources: G2, Reddit, NIST/GitHub advisories, Umbraco's own pages, and analyst listings.

Sources

  1. Umbraco CMS – official siteumbraco.com
    official
  2. Umbraco Products – G2 reviewsg2.com
    review
  3. G2 Winter 2026 Leader announcementumbraco.com
    official
  4. Reddit: Umbraco Cloud – Avoid like the plaguereddit.com
    review
  5. Reddit: Best .NET CMS for enterprise developmentreddit.com
    review
  6. NVD: CVE-2025-67288nvd.nist.gov
    security
  7. CVE-2026-46616 (SentinelOne)sentinelone.com
    security
  8. Umbraco Forms advisory (GitHub)github.com
    security
  9. Umbraco Cloud pricingumbraco.com
    official
  10. Annual Price Changes 2026umbraco.com
    official
  11. Gartner: Umbraco alternativesgartner.com
    review
  12. List of Umbraco CMS customersappsruntheworld.com
    news
  13. Renault case studyumbraco.com
    official
  14. Umbraco by Industryumbraco.com
    official

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.