CVE-2026-120205

HIGH 8.0

Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

CVSS Score

8.0

EPSS Score

0.0%

EPSS Percentile

0th

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.

CWE	CWE-79
Vendor	thelia
Product	thelia
Published	Oct 31, 2026

Stay Ahead of the Next One

Get instant alerts for thelia thelia

Be the first to know when new high vulnerabilities affecting thelia thelia are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

Thelia / Thelia

0 < 3.1.0

Thelia / Thelia Core

0 < 3.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/thelia/thelia/security/advisories/GHSA-r63g-6wfg-v5v9 github.com: https://github.com/thelia/thelia/commit/c90d59375089a0833a56703c6f9f9ddea17bddc9 github.com: https://github.com/thelia/thelia/releases/tag/3.1.0 github.com: https://github.com/thelia/thelia/blob/3.0.0/core/lib/Thelia/Condition/Implementation/ForSomeCustomers.php#L119 vulncheck.com: https://www.vulncheck.com/advisories/thelia-before-3.1.0-stored-xss-via-coupon-condition-customer-name

Credits

pnn219