CVE-2026-109960: Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customerindex.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.14
Event History
Frequently Asked Questions
Who can exploit this issue, and what administrator action triggers it?
An authenticated Froxlor customer can set a malicious theme value through customer_index.php. The payload executes when an administrator opens the customer overview while the Theme column is enabled.
What is the likely impact after the payload executes in an administrator's browser?
The injected script can abuse the administrator's CSRF token. This can allow creation of administrator accounts or changes to server settings.
Which versions are affected?
Froxlor versions from 2.0.0 before 2.3.14 are affected.