Description
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify product information.
Remediation
References
Related Vulnerabilities
WordPress Plugin qTranslate X Multiple Cross-Site Scripting Vulnerabilities (3.4.6.8)
XWiki Server-Side Request Forgery (SSRF) Vulnerability (CVE-2023-48240)
Jboss EAP Improper Resource Shutdown or Release Vulnerability (CVE-2025-9784)
WordPress Plugin Pinterest Automatic Pin Security Bypass (4.14.3)