What’s Vulnerable › Vulnerabilities
CVE-2026-4264: Reflected Cross-Site Scripting in BeeTienda eCommerce platform
- Severity: medium (CVSS 5.1 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-09 · updated 2026-10-09
- Weakness: CWE-79
Description
Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the 'search' parameter, they are displayed insecurely in the HTML response, allowing for the arbitrary execution of JavaScript code in the victim's browser.
Affected products
- BeeTienda eCommerce Platform: before November 2025 — fixed in November 2025
How to fix
Upgrade to a fixed version: BeeTienda eCommerce Platform November 2025. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-4264 or the next vulnerability affects your stack