CVE-2026-128041

CVSS 8.8 (high) · published 2026-11-13

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that executes when an administrator opens the pending-reviews feed, enabling admin account takeover.

Weakness: CWE-79

Source: NVD CVE-2026-128041

References

• https://github.com/OpenMage/magento-lts/commit/34e88f5447dff22e4ddc8cb0952d934ac3fdd15b
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-j9c5-pcvx-jx9x
• https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-rss-review-feed

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.