Stored Cross-Site Scripting Vulnerability in Thelia Software
CVE-2026-120205

7.4HIGH

Key Information:

Vendor

Thelia

Status
Thelia
Thelia Core
Vendor
CVE Published:
31 October 2026

What is CVE-2026-120205?

Thelia versions prior to 3.1.0 are susceptible to a stored cross-site scripting vulnerability that enables unauthorized users to inject malicious scripts. This flaw exists within the ForSomeCustomers::getSummary() function, where user inputs, specifically customer names, are not properly sanitized. Attackers may exploit this vulnerability by registering with an unescaped name containing a script payload. When administrators access related coupon information, the injected scripts execute, potentially enabling attackers to hijack CSRF tokens, which may lead to unauthorized account creation with administrative privileges.

Affected Version(s)

Thelia 0 < 3.1.0

Thelia Core 0 < 3.1.0

References

https://github.com/thelia/thelia/security/advisories/GHSA...
vendor-advisory
https://github.com/thelia/thelia/commit/c90d59375089a0833...
patch
https://github.com/thelia/thelia/releases/tag/3.1.0
release-notes

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

pnn219
.