nopCommerce 4.90.0: XSS Vulnerability Unleashes HTML Chaos!
nopCommerce 4.90.0 has been bitten by the notorious Cross Site Scripting (XSS) bug through its Attributes functionality. It’s a classic case of “JavaScript gone wild,” where attackers can sneak scripts into the Name field, waiting for a curious privileged user to trigger the mayhem.
Hot Take:
Who knew that a simple name input could turn into a playground for cyber trickery? Looks like nopCommerce 4.90.0 is serving up a side of JavaScript with its attributes. Somebody call the cyber exterminators because we’ve got some XSS bugs to squash!
Key Points:
- This vulnerability is found in the nopCommerce 4.90.0 version.
- The issue stems from the Attributes management workflow.
- Attackers can exploit this through the Name field in the Add Group section.
- Privileged users are the ones who need to visit the affected pages to trigger the exploit.
- The vulnerability has been assigned CVE-2025-65589.
Already a member? Log in here