CVE-2026-103527: XSS
Published Oct 12, 2026
·Updated
Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.
Affected Software
1 affected component
Thelia Thelia=2.6.0
Event History
Oct 12, 2026
CVE Published
via MITRE·02:54 PM
Data Sourced
via MITRE·02:54 PM
DescriptionWeakness
Data Sourced
via NVD·03:17 PM
Description