XSS Alert: Blog Posts on nopCommerce 4.90.0 Vulnerable to Exploits!
Watch out, bloggers! nopCommerce 4.90.0 has a Cross Site Scripting (XSS) vulnerability lurking in its blog posts. Add some malicious spice to the Body overview field, and voilà—instant chaos! Keep your content management area safe, or you might end up with more than just cat videos on your blog!
Hot Take:
Ah, nopCommerce, always keeping us on our toes! Just when you thought it was safe to blog about your cats or your favorite lasagna recipe, along comes a sneaky XSS vulnerability to spice things up. Who knew vulnerability disclosure could be as thrilling as a soap opera?
Key Points:
- nopCommerce version 4.90.0 is susceptible to a Stored XSS vulnerability.
- The vulnerability is located in the “Content Management” area, specifically within the “Blog posts” functionality.
- Malicious HTML/JavaScript can be injected into the Body overview field of a blog post.
- Once stored, the malicious code executes when the blog page is accessed.
- Assigned CVE code for this vulnerability is CVE-2025-65590.
Already a member? Log in here