Executive brief
nopCommerce, a popular open-source e-commerce platform, is vulnerable to a security flaw that allows attackers to inject malicious scripts into product names. When a customer views the affected product in the online store, the script automatically runs in their browser. This could allow an attacker to steal session cookies, redirect users to malicious websites, or perform unauthorized actions on behalf of the customer.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in nopCommerce 4.40.3 within the 'Product Name' field at the /Admin/Product/Edit/[id] endpoint. The application fails to properly sanitize this input before rendering it on the public-facing shop pages. An attacker with administrative privileges can inject an obfuscated SVG-based payload (e.g., using onload handlers and Unicode escapes) to bypass basic filters. When any user (including unauthenticated customers) views the compromised product page, the payload executes arbitrary JavaScript in the context of their browser session. This can lead to session hijacking or unauthorized data exfiltration.
Affected products
- nopCommerce nopCommerce 4.40.3
Timeline
- 2021-10-13: disclosed: CVE reserved date
- 2025-10-01: disclosed: Public exploit published by Scott Sturrock
- 2025-10-03: advisory: NVD published date