What is the CVSS score of CVE-2021-47897?

CVE-2021-47897 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2021-47897?

CVE-2021-47897 is a cross-site scripting (XSS) vulnerability in the change_params.php script that allows attackers to inject malicious code through the address parameter.

Is there a public PoC exploit available for CVE-2021-47897?

Yes, a public proof-of-concept exploit is available for CVE-2021-47897. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2021-47897?

Within 24 hours: Disable or restrict access to the change_params.php script until mitigation is in place; audit application logs for exploitation attempts. Within 7 days: Implement Web Application Firewall (WAF) rules to sanitize the address parameter and block script injection patterns; validate all input fields for XSS vectors. Within 30 days: Coordinate with vendor on patch timeline; conduct security assessment of all similar input parameters in the application; deploy patched version once available.

PHP CVE-2021-47897

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-01-23 disclosure@vulncheck.com

PHP XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 26, 2026 - 15:03 vuln.today

Public exploit code

CVE Published

Jan 23, 2026 - 17:16 nvd

HIGH 7.2

DescriptionCVE.org

PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the address parameter of the change_params.php script. Attackers can inject malicious JavaScript payloads that execute when users interact with the address text box, potentially enabling client-side script execution.

AnalysisAI

address parameter of the change_params.php script. Attackers can inject malicious JavaScript payloads is affected by cross-site scripting (xss) (CVSS 7.2).

Technical ContextAI

This vulnerability (CWE-79: Cross-site Scripting (XSS)) exists in the address component. PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the address parameter of the change_params.php script. Attackers can inject malicious JavaScript payloads that execute when users interact with the address text box, potentially enabling client-side script execution.

Affected ProductsAI

Product: address parameter of the change_params.php script. Attackers can inject malicious JavaScript payloads. Component: address.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.