Stored Cross-Site Scripting Vulnerability in OpenCart by OpenCart
CVE-2025-45892

6.1MEDIUM

Key Information:

Vendor

OpenCart

Status
OpenCart
Vendor
CVE Published:
25 July 2025

What is CVE-2025-45892?

The vulnerability in OpenCart version 4.1.0.4 allows for Stored Cross-Site Scripting (XSS) attacks through the blog editor. Due to inadequate sanitization or escaping of user input before rendering, attackers can inject and execute arbitrary JavaScript code in the context of the user's browser. This could lead to data theft, session hijacking, and other malicious activities targeting users interacting with the affected blog features.

References

https://www.opencart.com
https://packetstorm.news/files/id/202886

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.