Thelia CVE-2026-103524

Exploitation requires an authenticated administrative account with permission to use the affected back-office functions - specifically category creation and product creation - where user-supplied input is stored without sufficient output encoding or sanitization (PR:H). Execution additionally requires that a victim subsequently views the affected page (UI:R), either another administrator in the admin interface or a shopper on the web store's product pages. Limiting factors: this is not reachable by anonymous/unauthenticated attackers, it needs a second user to load the poisoned content to fire, and impact is confined to in-browser script execution (no direct server compromise). Affected scope is Thelia versions 0 through 2.6.0.

This is a genuinely low-to-moderate priority issue, not a critical one, and the signals are internally consistent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base 4.8 Medium) tells the real story: although the attack vector is network-based, exploitation requires high privileges (PR:H - an authenticated administrator with rights to create categories/products) AND victim interaction (UI:R - someone must subsequently view the poisoned page). The scope change (S:C) and Low confidentiality/integrity impacts reflect classic stored XSS executing script in a victim's browser session rather than compromising the server. EPSS reinforces low urgency at 0.17% (5th percentile), indicating very low modeled exploitation probability. There is no CISA KEV listing and no POC referenced in the supplied data, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was provided. The one point worth verifying: because PR:H means the attacker must already be a trusted admin-level user, real-world risk is dominated by insider/privilege-abuse and multi-tenant admin scenarios rather than anonymous internet attack, which further depresses practical risk despite the AV:N label.

A low-privileged or rogue back-office administrator (or an attacker who has compromised such an account) injects a malicious JavaScript payload into a stored field such as a category or product name during creation. When a higher-privileged administrator later opens the admin interface, or a shopper views the affected product page, the script executes in their browser session, enabling session/token theft or actions in the victim's context. No public proof-of-concept is referenced in the available data.