{"id":"CVE-2026-128041","aliases":["GHSA-j9c5-pcvx-jx9x"],"url":"https://o3.security/vulnerability/CVE-2026-128041","summary":"OpenMage magento-lts before 20.18.2 Stored XSS via RSS Review Feed","details":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that executes when an administrator opens the pending-reviews feed, enabling admin account takeover.","published":"2026-11-13T09:33:57.636Z","modified":"2026-11-14T02:45:15.853923742Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/OpenMage/magento-lts/commit/34e88f5447dff22e4ddc8cb0952d934ac3fdd15b","label":"OpenMage/magento-lts@34e88f5"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128041.json"},{"type":"FIX","url":"https://github.com/OpenMage/magento-lts/commit/34e88f5447dff22e4ddc8cb0952d934ac3fdd15b"},{"type":"ADVISORY","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-j9c5-pcvx-jx9x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128041"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-rss-review-feed"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-14T02:45:15.853923742Z"}}