Description
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into the attribute set name when listing the products.
Remediation
References
Related Vulnerabilities
WordPress Plugin Advanced Access Manager Cross-Site Scripting (6.7.9)
WordPress Plugin Style Kits-Advanced Theme Styles for Elementor Cross-Site Request Forgery (1.8.0)
WordPress Plugin WP Retina 2x Cross-Site Scripting (5.2.0)
Moodle Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-5540)
Django Authentication Bypass by Spoofing Vulnerability (CVE-2026-3902)