CVE-2026-128041: OpenMage magento-lts before 20.18.2 Stored XSS via RSS Review Feed
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that executes when an administrator opens the pending-reviews feed, enabling admin account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.18.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.0.0-beta3
Event History
Frequently Asked Questions
Who can exploit this issue, and what administrator action triggers it?
An unauthenticated guest can submit a product review containing script in the nickname, title, or review text. The script executes when an administrator opens the pending-reviews RSS feed.
Which deployments are affected?
OpenMage magento-lts versions before 20.18.2 are affected. The issue also affects 21.0.0 beta releases before 21.0.0-beta3.
What is the likely impact if exploitation succeeds?
Because the payload runs in the administrator's browser when the feed is opened, an attacker can take over the administrator account. The vulnerability has high confidentiality and integrity impact, while no availability impact is indicated.