CVE-2026-120248Medium· 4.8▾ SunlitThelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. At…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.
Thelia < 3.1.1core < 3.1.1back-office_default_twig_template < 1.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120205High· 8.0Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
CVE-2026-103527Medium· 6.1Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link con…
CVE-2026-103524Medium· 4.8Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface
CVE-2026-120206Medium· 5.9Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
CVE-2026-112285Medium· 4.3Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
CVE-2026-109396Medium· 4.2Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields