What’s Vulnerable › Vulnerabilities

CVE-2026-104479: Shopclass before 6.2.0 Stored XSS via Listing Description Field

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-03 · updated 2026-10-06
• Weakness: CWE-79

Description

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping, causing it to execute in the site origin for any visitor viewing the listing.

Affected products

• mindstellar shopclass: before 6.2.0 — fixed in 6.2.0

How to fix

Upgrade to a fixed version: mindstellar shopclass 6.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/mindstellar/shopclass
• https://github.com/mindstellar/shopclass/commit/c196f70906522c9b9172c24f1b42cd0a02357422
• https://www.vulncheck.com/advisories/shopclass-before-6.2.0-stored-xss-via-listing-description-field

Get alerted when CVE-2026-104479 or the next vulnerability affects your stack