Stored Cross-Site Scripting in OpenMage Magento-LTS Affects Admin Capabilities

CVE-2026-128040

What is CVE-2026-128040?

OpenMage Magento-LTS versions prior to 20.18.2 and 21.0.0-beta1 (before 21.0.0-beta3) are vulnerable to a stored cross-site scripting (XSS) vulnerability. This security flaw arises from the inadequate escaping of user-controlled inputs, such as Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames, on admin pages. An attacker with administrative privileges confined to a specific area can exploit this weakness by embedding malicious scripts that execute when another administrator accesses the compromised page, thereby potentially hijacking the session and executing actions with the privileges of the unsuspecting admin.

References