Shopclass CVE-2026-104479

Exploitation requires three conditions to hold together: (1) the site admin must have enabled the non-default 'use TinyMCE on the frontend' option - per the vendor CHANGELOG this is off unless explicitly turned on, and on default configurations the plain-textarea path strips every tag so the flaw is not present; (2) the attacker must hold a self-registered non-admin account with permission to post an item listing (PR:L); and (3) a victim must passively view the malicious listing for the stored script to fire (UI:P). The specific vulnerable code path is ItemActions.php::prepareData(), which read the 'description' parameter with Params' XSS check switched off (Params::getParam('description', false, false)) and stored it without any replacement sanitization. These factors - non-default configuration, required authentication, and required victim page view - materially limit realistic exploitation despite the network attack vector.

This is a medium-severity stored XSS (vendor CVSS 4.0 base 5.1) whose real-world risk is tightly bounded, and the signals largely agree rather than conflict. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N with subsequent-system SC:L/SI:L) correctly reflects a network-reachable but authenticated (PR:L - a self-registered non-admin account) flaw that needs a victim to passively view the listing (UI:P), yielding only low confidentiality/integrity impact typical of script execution in another user's browser. No EPSS score, KEV listing, or POC was supplied in the intelligence, so exploitation probability cannot be quantified; based on the available data there is no public exploit identified at time of analysis. The most important risk-limiting signal is not in the CVSS vector at all but in the vendor source evidence: the vulnerable path only exists when an admin has turned on the non-default 'use TinyMCE on the frontend' setting - everywhere else Params' XSS check strips every tag, so the issue is unexploitable. The net picture is a genuine but conditional, authenticated, user-interaction-dependent XSS: a real issue to patch for sites using the frontend rich editor, not a high-urgency mass-exploitation threat.

An attacker self-registers an ordinary (non-admin) account on a Shopclass site that has the frontend TinyMCE rich editor enabled, then submits an item listing whose description contains a <script> payload, which ItemActions.php stores verbatim because the tag-stripping XSS check is disabled on the rich-editor path. The script then executes in the site's origin in the browser of any visitor - or the author - who opens the listing, enabling session/cookie theft or UI manipulation. No public exploit code was identified in the provided data, though the fix commit publicly documents the vulnerable path.