CVE-2026-120205 — Vulnerability intelligence

Thelia — Thelia, Thelia Core

Published: 2026-10-31T17:25:53.467Z

CVSS

7.4

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.

Sources

• CVE-2026-120205
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• CVE-2026-120205