PT-2026-146533

CVE-2026-128051

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 3.1

3.5

Low

MetricsAV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages.

Exploitability

Fix

Impacts

Researchers

Colinmollenhour

Hanmac

V3Rticalmoney

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers