CVE-2022-28450

Name of the Vulnerable Software and Affected Versions nopCommerce version 4.50.1

Description The issue allows a remote attacker to execute arbitrary JavaScript code at the client's browser via Cross Site Scripting (XSS) through the Text parameter when creating a new post in the forums.

Recommendations For nopCommerce version 4.50.1, consider restricting access to the Text parameter in the forums to minimize the risk of exploitation until a patch is available. Avoid using the Text parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.