Stored Cross-Site Scripting in Shopclass Product by Mindstellar
CVE-2026-104479

5.1MEDIUM

Key Information:

Vendor

Mindstellar

Status
Shopclass
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104479?

The Shopclass product by Mindstellar is vulnerable to a stored cross-site scripting flaw, which affects versions prior to 6.2.0. This vulnerability enables self-registered non-admin users to embed malicious JavaScript scripts into item listing descriptions when the frontend TinyMCE editor is enabled. Due to a lack of proper tag stripping in the ItemActions.php file, this malicious content can execute within the context of the site for any visitor viewing the affected listing, posing serious security risks.

Affected Version(s)

shopclass 0 < 6.2.0

shopclass 6.2.0

References

https://github.com/mindstellar/shopclass/commit/c196f7090...
patch
https://github.com/mindstellar/shopclass
product
https://www.vulncheck.com/advisories/shopclass-before-6.2...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Islomjon Tursunov
.