CVE-2026-120248

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logofile or bannerfile images. Attackers can upload an SVG with an onload payload served from...

CVE-2026-120248 Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logofile or bannerfile images. Attackers can upload an SVG with an onload payload served from...

CVE-2026-120248

The Thelia e-commerce platform, prior to version 3.1.1 , is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the lack of sanitization for SVG images uploaded as logo_file or banner_file . Authenticated back-office administrators with store update permissions can exploit t...

EUVD-2026-114745

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logofile or bannerfile images. Attackers can upload an SVG with an onload payload served from...