TPVEnlanube CVE-2026-7170

Requires an authenticated account with access to the VirtueMart store administration function (the '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart' endpoint) to submit the malicious 'vendor_store_name' value - so PR:L, valid credentials on the Joomla/VirtueMart backend. Execution is limited by UI:A: the injected script only fires when a separate administrator or user later views the affected store record, so no impact occurs without that victim rendering the stored data. Limiting factors: authentication is mandatory, the store-management feature must be reachable by the attacker's account, and a privileged victim must open the poisoned record.

This is a low-priority, high-friction stored XSS. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:A/VC:N/VI:N/VA:N/SI:L) scores only 4.8 and captures the limitations well: exploitation requires an authenticated attacker (PR:L) to inject the payload, and firing it requires a second, higher-privileged user to view the malicious store data (UI:A - passive victim interaction). There is no EPSS score, no CISA KEV listing, and no public POC in the provided intelligence, so this is 'no public exploit identified at time of analysis.' The vendor scoped impact narrowly to integrity-only (VC:N/VI:N/VA:N with SI:L), which understates a typical stored XSS - script execution in an admin browser usually yields at least limited confidentiality (session/token theue) and integrity impact, so my independent 3.1 assessment (~6.1, S:C, C:L/I:L) is somewhat higher. Net: a real but constrained bug requiring valid credentials and admin/user interaction; not a mass-exploitation candidate. Note the CPE string 'cloud_web_application' is a junk generic identifier and does not reflect the actual product (a Joomla/VirtueMart extension), which weakens automated matching.

An authenticated vendor/store operator on the Joomla site adds or edits a store and enters a JavaScript payload into the 'vendor_store_name' field via the com_virtuemart store.store_add admin endpoint. The payload is stored unsanitized and later executes in the browser of any administrator or user who views that store record, enabling session/cookie theft or admin actions in the victim's context. No public POC or exploit code was identified in the provided sources.