CVE-2026-103524
Received Received - Intake

Stored XSS in Thelia Admin Interface and Product Pages

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: CERT/CC

Description
Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-103524
EUVD
EUVD-2026-97477

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Thelia Thelia 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Thelia v2.6.0 has multiple stored cross-site scripting (XSS) vulnerabilities in its admin interface. User input is saved without proper encoding or sanitization and later displayed in admin pages or product pages, enabling attackers to run arbitrary JavaScript when those pages load.

Detection Guidance

To detect this vulnerability, inspect Thelia v2.6.0 administrative interfaces for stored XSS vectors. Check product and category creation forms for unsanitized input fields. Manually review stored data in the database for malicious scripts. Use browser developer tools to monitor network requests and responses for suspicious payloads.

Impact Analysis

An attacker could inject malicious scripts into product or category pages. When viewed by administrators or customers, these scripts could steal session cookies, redirect users to phishing sites, or perform actions on behalf of the user without their consent.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face fines or penalties for failing to protect sensitive data due to this flaw.

Mitigation Strategies

Upgrade Thelia to the latest version beyond v2.6.0. Apply output encoding for all user-supplied data in administrative and storefront interfaces. Implement input validation for category and product creation forms. Sanitize stored data before rendering in web pages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103524. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart