CVE-2026-128040
OpenMage magento-lts before 20.18.2 Stored XSS via Admin Dataflow, Tax, OAuth, PayPal Fields
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges.
| CWE | CWE-79 |
| Vendor | openmage |
| Product | magento-lts |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for openmage magento-lts
Be the first to know when new medium vulnerabilities affecting openmage magento-lts are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
OpenMage / magento-lts
0 < 20.18.2
OpenMage / magento-lts
21.0.0-beta1 < 21.0.0-beta3
References
github.com: https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m858-x59w-rmp5 github.com: https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de github.com: https://github.com/OpenMage/magento-lts/commit/7f7a9deaac11fd2437bb1f8065db152a4b620609 github.com: https://github.com/OpenMage/magento-lts/commit/62d2885fa6e7a4454e3a5c7765a6a5ca0085ecc1 github.com: https://github.com/OpenMage/magento-lts/commit/e97e257b8f8d74d2e52dbf28caa211c262ff26be vulncheck.com: https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-admin-dataflow-tax-oauth-paypal-fields
Credits
🔍 UltraRamy colinmollenhour Hanmac