CVE-2025-27400— Magento vulnerable to stored XSS in theme config fields
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-27400
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Magento vulnerable to stored XSS in theme config fields
Source: NVD (National Vulnerability Database)
Vulnerability Description
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.0 contain a patch for the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
magento-lts 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
magento-lts是OpenMage开源的一个用于Magento CE官方版本的可靠替代品。 magento-lts 20.12.3之前版本和20.13.1之前版本存在跨站脚本漏洞，该漏洞源于管理面板存在脚本执行，可能导致跨站脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OpenMage | magento-lts | < 20.12.3 | - |
II. Public POCs for CVE-2025-27400
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-27400
请登录查看更多情报信息。
- Release v20.13.0 🌈 · OpenMage/magento-lts · GitHubx_refsource_MISC
- Release v20.12.3 · OpenMage/magento-lts · GitHubx_refsource_MISC
- Stored XSS in theme config fields · Advisory · OpenMage/magento-lts · GitHubx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2025-27400
IV. Related Vulnerabilities
Same product: magento-lts
- CVE-2026-40488
OpenMage LTS has Customer File Upload Extension Blocklist By - CVE-2026-40098
OpenMage LTS imports cross-user wishlist item via shared wis - CVE-2026-25525
OpenMage LTS has Path Traversal Filter Bypass in Dataflow Mo - CVE-2026-25524
OpenMage LTS's Phar Deserialization leads to Remote Code Exe - CVE-2026-25523
Magento's X-Original-Url header can expose admin url
Same vendor: OpenMage
- CVE-2026-40488
OpenMage LTS has Customer File Upload Extension Blocklist By - CVE-2026-40098
OpenMage LTS imports cross-user wishlist item via shared wis - CVE-2026-25525
OpenMage LTS has Path Traversal Filter Bypass in Dataflow Mo - CVE-2026-25524
OpenMage LTS's Phar Deserialization leads to Remote Code Exe - CVE-2026-25523
Magento's X-Original-Url header can expose admin url
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2025-27400
No comments yet