{"id":"CVE-2026-120205","kind":"vulnerability","aliases":["CVE-2026-120205"],"related":[],"title":"Thelia: stored script injection via customer names runs in admin view","description":"Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.","summary":"Thelia, an open-source PHP e-commerce platform, does not escape customer names when showing coupon summaries. An unauthenticated attacker who registers with a script as their name can run that script in an administrator's browser, stealing CSRF tokens to create new administrator accounts.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","package","php","self-hosted","thelia"],"not_affected_if":["registration-closed","thelia-3.1.0-or-later"],"how_to_check":"- Check the installed Thelia version in `composer.json` or the lock file.\n- Confirm whether customer self-registration is open on the shop.","fix":"- Thelia: move to `3.1.0` or later.","status":"open","published_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","triaged_at":"2026-10-31T18:38:35+00:00","updated_at":"2026-10-31T18:38:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-31T18:38:35Z","model":"claude-haiku-5-5","output":{"fix":"- Thelia: move to `3.1.0` or later.","reach":"internet","title":"Thelia: stored script injection via customer names runs in admin view","impact":"high","summary":"Thelia, an open-source PHP e-commerce platform, does not escape customer names when showing coupon summaries. An unauthenticated attacker who registers with a script as their name can run that script in an administrator's browser, stealing CSRF tokens to create new administrator accounts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["thelia","php","e-commerce","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"admin session hijacked, attacker creates administrator accounts","analyst_note":"Confirm the affected version range and whether a patch or advisory page exists beyond the NVD entry.","how_to_check":"- Check the installed Thelia version in `composer.json` or the lock file.\n- Confirm whether customer self-registration is open on the shop.","plain_action":"","needs_analyst":true,"not_affected_if":["thelia-3.1.0-or-later","registration-closed"],"who_is_affected":"Shops running Thelia before 3.1.0 that accept public customer registration are exposed, because the malicious name is stored and fires when an admin views related coupons. Sites with registration closed or Thelia 3.1.0 and later can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4152,"output_tokens":520,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120205':14A,17A '-2026':13A,16A '3.1.0':76C 'account':73B,122C 'admin':10A 'administr':63B,72B,112C,121C 'allow':89C 'attack':48B,91C,99C 'browser':65B 'commerc':20B,35B 'contain':77C 'coupon':44B,115C 'creat':70B,120C 'cross':81C 'cross-sit':80C 'csrf':67B,117C 'custom':6A,40B,97C 'cve':12A,15A 'e':19B,34B 'e-commerc':18B,33B 'escap':39B 'execut':110C 'forsomecustom':86C 'getsummari':87C 'host':25B 'inject':4A,93C 'name':7A,41B,56B,98C,108C 'new':71B 'open':30B 'open-sourc':29B 'packag':21B 'payload':105C 'php':22B,32B 'platform':36B 'regist':50B,101C 'relat':114C 'run':8A,58B 'script':3A,53B,60B,83C,94C,104C 'self':24B 'self-host':23B 'show':43B 'site':82C 'sourc':31B 'steal':66B,116C 'store':2A,79C 'summari':45B 'thelia':1A,26B,27B,74C 'token':68B,118C 'unauthent':47B,90C 'unescap':96C 'via':5A,95C 'view':11A,113C 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Shops running Thelia before 3.1.0 that accept public customer registration are exposed, because the malicious name is stored and fires when an admin views related coupons. Sites with registration closed or Thelia 3.1.0 and later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T18:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120205","severity":null,"published_at":"2026-10-31T18:17:08+00:00","modified_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","fetched_at":"2026-10-31T18:37:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}