CVE-2026-7170: Stored Cross-Site Scripting (XSS) in TPVEnlanube
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter:
CVE-2026-7170: parameter 'vendorstorename' in the endpoint '/administrator/index.php?pshopmode=admin&page=store.storeadd&option=comvirtuemart&vendorid=[ID]'.
Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue requires an authenticated attacker who can submit data to the store-add administrative endpoint and control the vendor_store_name parameter.
Which users could be affected by a stored payload?
A successful stored XSS payload can execute in the browsers of users who later view the affected content, without their consent. The available information does not identify the specific user roles or pages that render the stored value.
How can I check for possible exploitation?
Review values submitted to vendor_store_name through /administrator/index.php with pshop_mode=admin, page=store.store_add, option=com_virtuemart, and a vendor_id parameter. Look for unexpected HTML or script-like content in stored vendor store names.