AI analysis
Thelia v2.6.0 (and, per CERT advisory VU#162329, 2.6.1) contains multiple stored cross-site scripting (XSS) flaws. User-supplied input submitted through administrative functions such as category creation and product creation is stored without adequate output encoding or sanitization, and is later rendered in the administrator interface and on the store's public product pages. When an administrator or a shopper views a poisoned page, the attacker's JavaScript executes in that victim's browser, enabling cookie/session theft, hijacked admin actions, or defacement of storefront content. Any deployment of Thelia 2.6.x that lets multiple staff or contributors create categories and products is exposed, as are customers browsing tampered product pages. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and there is no evidence of exploitation in the wild.
What to do: Apply the fix referenced in CERT advisory VU#162329 and move off Thelia 2.6.0/2.6.1 as soon as a patched release is confirmed by the maintainers. Until then, restrict category/product creation to trusted administrators only, and audit existing category names, product titles, and description fields for injected script tags. Consider deploying a Content-Security-Policy header on both the admin interface and storefront to limit the impact of any stored XSS that slips through.
Affected
| Thelia (open-source PHP e-commerce) Thelia | — |
Estimated exposure
moderate≈ a few thousand live Thelia stores (order of 10³) — clearly an estimate — Thelia is a self-hosted PHP shopping cart with modest adoption, and public web-technology surveys have historically attributed only a few thousand live sites to it; no authoritative install count is available.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.