Stored XSS Vulnerability in Magento-lts Affects OpenMage Products

CVE-2025-64174

What is CVE-2025-64174?

The Magento-lts product, which serves as a long-term support alternative to Magento Community Edition, contains a vulnerability allowing for stored Cross-Site Scripting (XSS). This issue impacts versions 20.15.0 and lower, enabling an attacker with backend access or an administrator to inject malicious scripts through unescaped translation strings and URLs located in specific code files. This flaw can lead to unauthorized actions and harmful consequences if exploited. The vulnerability has been addressed in version 20.16.0 of the product.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References