{"id":"CVE-2026-128051","kind":"vulnerability","aliases":["CVE-2026-128051"],"related":[],"title":"OpenMage magento-lts: stored XSS via unescaped product names in storefront","description":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages.","summary":"OpenMage magento-lts does not escape product names in the storefront MSRP/MAP popup and Qty Increments notice templates. A user with admin product-edit rights can store a malicious product name that runs script in shoppers' browsers on product, category, and wishlist pages.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["magento","magento-lts","openmage","package","php"],"not_affected_if":["auth-required","non-admin-product-editors"],"how_to_check":"- Check the installed magento-lts version in composer.json or the OpenMage package and compare it with `20.18.2` (stable line) and `21.0.0-beta3` (beta line)\n- Review admin accounts that hold product-edit rights and confirm they are trusted","fix":"- magento-lts: upgrade to `20.18.2` or later on the 20.x line\n- magento-lts 21.0.0-beta: upgrade to `21.0.0-beta3` or later","status":"open","published_at":"2026-11-13T10:18:10+00:00","first_seen_at":"2026-11-13T10:47:32+00:00","triaged_at":"2026-11-13T10:58:39+00:00","updated_at":"2026-11-13T10:58:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:58:39Z","model":"claude-haiku-5-5","output":{"fix":"- magento-lts: upgrade to `20.18.2` or later on the 20.x line\n- magento-lts 21.0.0-beta: upgrade to `21.0.0-beta3` or later","reach":"internet","title":"OpenMage magento-lts: stored XSS via unescaped product names in storefront","impact":"medium","summary":"OpenMage magento-lts does not escape product names in the storefront MSRP/MAP popup and Qty Increments notice templates. A user with admin product-edit rights can store a malicious product name that runs script in shoppers' browsers on product, category, and wishlist pages.","audience":"businesses","category":"package","nicknames":[],"who_cares":["magento","openmage","magento-lts","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker script runs in shoppers' browsers on storefront pages","analyst_note":"","how_to_check":"- Check the installed magento-lts version in composer.json or the OpenMage package and compare it with `20.18.2` (stable line) and `21.0.0-beta3` (beta line)\n- Review admin accounts that hold product-edit rights and confirm they are trusted","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","non-admin-product-editors"],"who_is_affected":"Stores running OpenMage magento-lts before 20.18.2, or 21.0.0-beta1 through beta2. Exposure needs an admin account with product-edit rights to store the payload, and then shoppers viewing affected storefront pages are at risk. Stores without the MSRP/MAP or Qty Increments features may be less exposed, but the sources do not say which templates are rendered by default.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000782,"input_tokens":4673,"output_tokens":629,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128051':15A,18A '-2026':14A,17A '20.18.2':76C '21.0.0':78C,81C 'admin':48B,108C 'attack':106C 'beta1':79C 'beta3':82C 'browser':64B 'categori':67B,126C 'contain':83C 'cross':87C 'cross-sit':86C 'cve':13A,16A 'edit':51B,111C 'escap':32B,105C 'execut':120C 'increment':42B,97C 'lts':4A,22B,29B,74C 'magento':3A,19B,21B,28B,73C 'magento-lt':2A,20B,27B,72C 'malici':56B,116C 'msrp/map':38B,93C 'name':10A,34B,58B,102C,118C 'notic':43B,98C 'openmag':1A,23B,26B,71C 'output':100C 'packag':24B 'page':70B,129C 'php':25B 'popup':39B,94C 'product':9A,33B,50B,57B,66B,101C,110C,117C,125C 'product-edit':49B,109C 'proper':104C 'qti':41B,96C 'right':52B,112C 'run':60B 'script':61B,89C,121C 'shopper':63B,123C 'site':88C 'store':5A,54B,85C,114C 'storefront':12A,37B,92C 'templat':44B,99C 'unescap':8A 'user':46B 'via':7A 'view':124C 'vulner':90C 'wishlist':69B,128C 'without':103C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Stores running OpenMage magento-lts before 20.18.2, or 21.0.0-beta1 through beta2. Exposure needs an admin account with product-edit rights to store the payload, and then shoppers viewing affected storefront pages are at risk. Stores without the MSRP/MAP or Qty Increments features may be less exposed, but the sources do not say which templates are rendered by default.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["magento","magentolts","medium","openmage","package","php"],"campaign_type":null,"search_a":"'-128051':15A,18A '-2026':14A,17A 'cve':13A,16A 'lts':4A 'magento':3A 'magento-lt':2A 'name':10A 'openmag':1A 'product':9A 'store':5A 'storefront':12A 'unescap':8A 'via':7A 'xss':6A","search_b":"'admin':48B 'browser':64B 'categori':67B 'edit':51B 'escap':32B 'increment':42B 'lts':22B,29B 'magento':19B,21B,28B 'magento-lt':20B,27B 'malici':56B 'msrp/map':38B 'name':34B,58B 'notic':43B 'openmag':23B,26B 'packag':24B 'page':70B 'php':25B 'popup':39B 'product':33B,50B,57B,66B 'product-edit':49B 'qti':41B 'right':52B 'run':60B 'script':61B 'shopper':63B 'store':54B 'storefront':37B 'templat':44B 'user':46B 'wishlist':69B","search_c":"'20.18.2':76C '21.0.0':78C,81C 'admin':108C 'attack':106C 'beta1':79C 'beta3':82C 'categori':126C 'contain':83C 'cross':87C 'cross-sit':86C 'edit':111C 'escap':105C 'execut':120C 'increment':97C 'lts':74C 'magento':73C 'magento-lt':72C 'malici':116C 'msrp/map':93C 'name':102C,118C 'notic':98C 'openmag':71C 'output':100C 'page':129C 'popup':94C 'product':101C,110C,117C,125C 'product-edit':109C 'proper':104C 'qti':96C 'right':112C 'script':89C,121C 'shopper':123C 'site':88C 'store':85C,114C 'storefront':92C 'templat':99C 'view':124C 'vulner':90C 'wishlist':128C 'without':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T19:59:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128051","severity":null,"published_at":"2026-11-13T10:18:10+00:00","modified_at":"2026-11-13T10:18:10+00:00","first_seen_at":"2026-11-13T10:47:32+00:00","fetched_at":"2026-11-13T10:47:32+00:00","note":null}],"documents":[{"id":145414,"url":"https://github.com/OpenMage/magento-lts/commit/2437b01af99279aa1c6ca5c19f919449b38a5a66","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145415,"url":"https://github.com/OpenMage/magento-lts/commit/64ff7fce3db72cad83e41131bdf48c42ba2ad2f2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145416,"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hfqq-c3qm-38x8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T19:59:38+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145417,"url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-name-in-msrp-popup","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}