CVE-2026-128051 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts does not escape product names in the storefront MSRP/MAP popup and Qty Increments notice templates. A user with admin product-edit rights can store a malicious product name that runs script in shoppers' browsers on product, category, and wishlist pages.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage magento-lts before 20.18.2, or 21.0.0-beta1 through beta2. Exposure needs an admin account with product-edit rights to store the payload, and then shoppers viewing affected storefront pages are at risk. Stores without the MSRP/MAP or Qty Increments features may be less exposed, but the sources do not say which templates are rendered by default.
Not affected if auth-required, non-admin-product-editors
Who cares magento, magento-lts, openmage, php
20.18.2 (stable line) and 21.0.0-beta3 (beta line)20.18.2 or later on the 20.x line21.0.0-beta3 or laterOpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.