CVE-2026-103527

CVE-2026-103527 PUBLISHED

Description (CNA)

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.

Affected (CNA)

Vendor / product	Versions
Thelia / Thelia	affected 0 through 2.6.0

CWE

No CWE identifiers supplied.

References

https://kb.cert.org/vuls/id/162329

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.