CVE-2026-104479

MEDIUMCVSS 5.4

Description

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping, causing it to execute in the site origin for any visitor viewing the listing.

Timeline

Published:October 3rd, 2026 12:16 AM

Last modified:October 5th, 2026 4:17 PM

CVSS Scoring

CVSS v3: 5.4 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

References & Reports

Advisories, patches, and third-party reports

https://github.com/mindstellar/shopclass
https://github.com/mindstellar/shopclass/commit/c196f70906522c9b9172c24f1b42cd0a02357422
https://www.vulncheck.com/advisories/shopclass-before-6.2.0-stored-xss-via-listing-description-field

Source: NIST NVD · Data may lag official sources by up to one minute