Cross-Site Scripting Vulnerability in Soteshop by Soteshop Technologies

CVE-2025-1776

What is CVE-2025-1776?

A Cross-Site Scripting (XSS) vulnerability exists in Soteshop prior to version 8.3.4 that could enable attackers to execute arbitrary code through the 'query' parameter in the '/app-google-custom-search/searchResults' endpoint. By manipulating this parameter, adversaries can potentially access and steal sensitive user data, including session cookies, or perform unauthorized actions on behalf of users. It is crucial for users of Soteshop to update their installations to mitigate this risk and safeguard against potential exploits.

References