CVE-2025-45892

—

CVSS 3.1

6.1 medium

EPSS

<1%p16

Published

Jul 25, 2025 (Jul 25, 2025)

Modified

Jun 17, 2026

Description

OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because input in the blog's editor is not properly sanitized or escaped before being rendered. This allows attackers to inject malicious JavaScript code

Vendors: opencart
Products: opencart
Ecosystems: E-commerce
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.