CVE-2026-120205

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-120205

The Thelia software (versions prior to 3.1.0 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the ForSomeCustomers::getSummary() function. The root cause is the handling of unescaped customer names , allowing unauthenticated attackers to register with a script payload as their name....

EUVD-2026-114726

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-120205 Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-120205: Thelia: Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows…

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...