CVE-2026-103527 | Vulnetix

CVE-2026-103527 PUBLISHED

Reported by certcc · Published October 12, 2026

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.

Affected Products

Vendor	Product	Versions
Thelia	Thelia	0
Thelia	Thelia	0

Timeline

Oct 12, 2026 Coalition ESS Score
Oct 12, 2026 CVE Published
Oct 13, 2026 CVE Updated

References

Open in Interactive Console →