CVE-2026-120205

Name of the Vulnerable Software and Affected Versions Thelia versions prior to 3.1.0

Description A stored cross-site scripting issue exists in the getSummary() function of the ForSomeCustomers class. Unauthenticated attackers can inject malicious scripts through unescaped customer names. By registering with a script payload as their name, the script executes when administrators view related coupons, potentially allowing the theft of CSRF (Cross-Site Request Forgery) tokens—a technique used to impersonate a user—to create unauthorized administrator accounts.

Recommendations Update to version 3.1.0 or later.