CVE-2026-128051: OpenMage magento-lts before 20.18.2 Stored XSS via Product Name in MSRP Popup
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3. The vulnerable output occurs in storefront MSRP/MAP popups and Qty Increments notices.
What access does an attacker need?
An attacker needs administrative product-edit permissions to save a malicious product name. The stored script can then execute when shoppers view product, category, or wishlist pages.
Are shoppers required to take any action for exploitation?
Yes. A shopper must view an affected product, category, or wishlist page where the unescaped product name is rendered through the vulnerable popup or notice templates.
How can I determine whether the issue may already be present?
Review product names for injected script or other unexpected markup, especially for products edited by administrative users. Also identify whether storefront MSRP/MAP popup or Qty Increments notice functionality renders those product names.