EUVD-2026-91855

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

CVE-2026-104479

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

CVE-2026-104479: Improper Neutralization of Input During Web Page Generation

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

PT-2026-104461

Name of the Vulnerable Software and Affected Versions Shopclass versions prior to 6.2.0 Description A stored cross-site scripting issue exists when the frontend TinyMCE is enabled. This allows self-registered non-admin users to inject malicious JavaScript into item listing descriptions. The...