CVE-2026-104479: Shopclass before 6.2.0 Stored XSS via Listing Description Field
Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping, causing it to execute in the site origin for any visitor viewing the listing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Shopclassto a version that resolves this vulnerability.Fixed in 6.2.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Shopclass versions before 6.2.0 are affected when frontend TinyMCE is enabled and self-registration allows non-admin users to create item listings.
What access does an attacker need?
An attacker needs a self-registered, non-administrative account and must be able to submit an item listing description. Exploitation also requires a visitor to view the malicious listing.
What happens when the vulnerability is exploited?
Malicious JavaScript placed in a listing description is saved without tag stripping and executes in the Shopclass site origin when the listing is viewed. This can affect visitors who open the attacker-controlled listing.
What is the available remediation?
Upgrade Shopclass to version 6.2.0 or later. If upgrading cannot happen immediately, disable frontend TinyMCE and restrict or review non-admin listing submissions.