EUVD-2026-91855

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

CVE-2026-104479

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

CVE-2026-104479: Improper Neutralization of Input During Web Page Generation

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

CVE-2026-104479 Shopclass before 6.2.0 Stored XSS via Listing Description Field

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

CVE-2026-104479 Shopclass before 6.2.0 Stored XSS via Listing Description Field

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

CVE-2026-104479

Versions of Shopclass prior to 6.2.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. When the frontend TinyMCE is enabled, self-registered non-admin users can inject malicious JavaScript into item listing descriptions. The root cause is that the ItemActions.php component save...

CVE-2026-104479 Shopclass before 6.2.0 Stored XSS via Listing Description Field

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

PT-2026-104461

Name of the Vulnerable Software and Affected Versions Shopclass versions prior to 6.2.0 Description A stored cross-site scripting issue exists when the frontend TinyMCE is enabled. This allows self-registered non-admin users to inject malicious JavaScript into item listing descriptions. The...