JTL-Shop CVE-2026-103904

Requires that the shop expose its public consent endpoint (consent-banner functionality) to unauthenticated visitors, which accepts and stores arbitrary unvalidated consent names - this is the default behavior described, so no non-default configuration is needed to inject. Exploitation is limited by the requirement that a shop administrator subsequently open the consent statistics page in the backend for the stored payload to execute (CVSS UI:P / passive victim interaction); the attacker cannot trigger execution directly and gains only the privileges of whichever administrator views the page. No attacker authentication is required (PR:N), and no special attacker-side platform or client is needed beyond the ability to send HTTP requests.

This is a genuine, credible-priority stored XSS (CWE-79) rather than an inflated high-CVSS issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H) is internally consistent with the description: an unauthenticated remote attacker (PR:N) can inject arbitrary consent names over the network (AV:N) with low complexity (AC:L), and the only gating factor is that an administrator must later view the consent statistics page (UI:P / passive victim interaction). The score of 8.6 is justified because successful exploitation yields execution in an administrator's authenticated session, enabling high-impact actions against the shop backend (VC:H/VI:H), with a subsequent-system impact flagged as low (SC:L/SI:L). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk here is driven by the ease of injection and the privilege of the victim, not by observed in-the-wild activity. The practical limiter is that exploitation is not fully automatable end-to-end: it depends on an administrator opening the specific statistics view, which makes this opportunistic/stored rather than wormable. No signals conflict; the main gap is the absence of exploitation-probability (EPSS) and exploitation-status (KEV/POC) telemetry, so the exploitation likelihood is inferred from the vector alone.

An unauthenticated attacker sends requests to JTL-Shop's public consent endpoint supplying consent 'names' containing a JavaScript payload instead of a valid configured consent item. The payload is persisted into the consent statistics and later rendered unencoded when a shop administrator opens the consent statistics page in the backend, executing the script in the admin's authenticated session. No public POC was provided, but the attack requires only crafted HTTP requests plus an administrator viewing the affected page.