Live › vulnerability › CVE-2026-120205
Thelia, an open-source PHP e-commerce platform, does not escape customer names when showing coupon summaries. An unauthenticated attacker who registers with a script as their name can run that script in an administrator's browser, stealing CSRF tokens to create new administrator accounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 18:37 UTC. All times on this page are UTC.
Shops running Thelia before 3.1.0 that accept public customer registration are exposed, because the malicious name is stored and fires when an admin views related coupons. Sites with registration closed or Thelia 3.1.0 and later can skip it.
No product ranges from the sources yet.
composer.json or the lock file.3.1.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-120205")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.