TPVEnlanube CVE-2026-7172

Requires an authenticated Joomla/VirtueMart account able to submit the 'Nombre Completo' (Full Name) field that feeds the VirtueMart administrator user-list page (admin.user_list) in a store running the TPVEnlanube extension. Exploitation is limited by three factors: authentication is required (PR:L), the stored payload only fires when a privileged user actively views the affected admin user-list page (UI:A), and the affected product is a niche Spanish payment-gateway extension with a small install base. Impact is confined to script execution in the viewing user's browser (integrity), with no direct server compromise.

This is a low-to-moderate real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) describes a network-reachable, low-complexity stored XSS that nonetheless requires an authenticated attacker (PR:L) AND active victim interaction (UI:A - a privileged user must open the affected VirtueMart user-list page), which meaningfully constrains exploitation. The vendor scored impact only as SI:L (subsequent-system integrity limited) with no confidentiality or availability impact, yielding 4.8. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is no SSVC decision data in the input. The primary risk signal is the combination of an authenticated foothold plus an admin viewing attacker-controlled data - a classic privilege-escalation-via-stored-XSS path (e.g., session/action hijack in the Joomla administrator context), which I assess as slightly higher-impact than the vendor's SI:L-only scoring suggests (I lean C:L/I:L, ~6.1 in CVSS 3.1). Net: a genuine but not urgent issue, gated by authentication and the tiny deployment footprint of the affected extension rather than a high-CVSS-but-low-risk mislabel.

An authenticated low-privilege user of a Joomla/VirtueMart store running the TPVEnlanube extension enters a malicious script payload into the 'Nombre Completo' (Full Name) field. The payload is stored and later rendered when an administrator opens the VirtueMart user-list admin page (/administrator/index.php?option=com_virtuemart&page=admin.user_list), executing the script in the admin's authenticated browser session. No public POC or exploit code was identified in the provided sources.