PT-2025-40285

CVE-2025-60991

Published

2025-10-01

Updated

2025-10-06

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Codazon Magento Themes versions 1.1.0.0 through 2.4.7

Description A reflected cross-site scripting (XSS) issue exists in Codazon Magento Themes. This allows attackers to execute arbitrary Javascript within a user's browser by injecting a crafted payload into the cat parameter. The attack is reflected, meaning the malicious script is executed when a user interacts with a specially crafted link.

Recommendations Update Codazon Magento Themes to a version later than 2.4.7.

Exploitability

Exploit

Fix

Impacts

Researchers

Shadowbyte1

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers