Stored XSS Vulnerabilities in Thelia v2.6.0 by Thelia

CVE-2026-103524

What is CVE-2026-103524?

Thelia v2.6.0 is vulnerable to stored XSS issues that can be exploited through its administrative interface. This vulnerability allows user-supplied data to be stored and then rendered without proper output encoding or sanitization. As a result, arbitrary JavaScript can be executed when viewing affected pages, potentially compromising the security of both administrators and users through various administrative functions, including category and product creation.

References