CVE-2026-120205High· 8.0▾ MidnightPoC availableThelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.
Thelia < 3.1.0core < 3.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120248Medium· 4.8Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads
CVE-2026-103527Medium· 6.1Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link con…
CVE-2026-103524Medium· 4.8Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface
CVE-2026-120206Medium· 5.9Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
CVE-2026-109396Medium· 4.2Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields
CVE-2026-112285Medium· 4.3Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders