Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.

Etkilenen sürümler2 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…thelia/security/advisories/GHSA-r63g-6wfg-v5v9 Üretici bülteni
• github.com/…ommit/c90d59375089a0833a56703c6f9f9ddea17bddc9 Yama
• vulncheck.com/…-stored-xss-via-coupon-condition-customer-name Üçüncü taraf
• github.com/thelia/thelia/releases/tag/3.1.0 Diğer
• github.com/…/Condition/Implementation/ForSomeCustomers.php Diğer

Kayıt geçmişi

1. 31 Eki 2026 20:25Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-120206Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
• 6,1 CVE-2026-104926WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter
• 6,4 CVE-2026-107711FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint
• 7,2 CVE-2026-120114Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint
• 6,1 CVE-2026-100151Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
• 6,4 CVE-2026-96554BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name