CVE-2025-40701: Reflected Cross-Site scripting (XSS) in SOTE's SOTESHOP

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-23 · updated 2026-06-17
Weakness: CWE-79

Description

Reflected Cross-Site Scripting vulnerability in SOTESHOP, version 8.3.4. THis vulnerability allows an attacker execute JavaScript code in the victim's browser when a malicious URL with the 'id' parameter in '/adsTracker/checkAds' is sent to the victim. The vulnerability can be exploited to steal sensitive user information such as session cookies, or to perform actions on their behalf.

Affected products

SOTESHOP: 8.3.4

References

https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-sotes-soteshop

Get alerted when CVE-2025-40701 or the next vulnerability affects your stack