CVE-2026-128051

Description

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages.

References

• https://github.com/OpenMage/magento-lts/commit/2437b01af99279aa1c6ca5c19f919449b38a5a66
• https://github.com/OpenMage/magento-lts/commit/64ff7fce3db72cad83e41131bdf48c42ba2ad2f2
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hfqq-c3qm-38x8
• https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-name-in-msrp-popup