Stored Cross-Site Scripting in OpenMage Magento-LTS

CVE-2026-128041

What is CVE-2026-128041?

OpenMage Magento-LTS versions before 20.18.2 and the beta releases 21.0.0-beta1 to 21.0.0-beta3 are susceptible to stored cross-site scripting (XSS) through improperly handled RSS feeds. An unauthenticated attacker can exploit this vulnerability by submitting a product review that includes malicious scripts within the nickname, title, or text fields. When an administrator views the pending reviews feed, the injected script executes, potentially allowing the attacker to take over the admin account. This oversight underscores the importance of adequate input sanitization and escaping mechanisms to prevent explosive security vulnerabilities.

References