CVE-2026-104479 | CVSS: 5.4 | 严重级别: MEDIUM
Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping, causing it to execute in the site origin for any visitor viewing the listing.
参考链接:
• https://github.com/mindstellar/shopclass
• https://github.com/mindstellar/shopclass/commit/c196f70906522c9b9172c24f1b42cd0a
• https://www.vulncheck.com/advisories/shopclass-before-6.2.0-stored-xss-via-listi
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。