# CVE-2025-13002: Farktor Software E-Commerce Package XSS

Source: https://junglewise.ai/threats/cve-2025-13002-farktor-software-e-commerce-package-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-12. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2025-13002 · Severity: high · CVSS 8.2 · Published 2026-02-12

Farktor Software's E-Commerce Package, a platform used for managing online retail stores, contains a security vulnerability that allows for cross-site scripting. An attacker could exploit this to inject malicious scripts into the web pages viewed by other users. This could lead to unauthorized actions being performed in a user's session or the defacement of the online storefront.

Technologies: [Farktor E-Commerce Package](https://junglewise.ai/threats/technologies/e-commerce-package). Vendors: [Farktor](https://junglewise.ai/threats/vendors/farktor).

## Quick answers

**Is CVE-2025-13002 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13002 being exploited in the wild.

**How severe is CVE-2025-13002?** High severity, with a CVSS score of 8.2, published 12 February 2026.

**Which products and versions are affected?** Farktor Software E-Commerce Services Inc. E-Commerce Package through 27112025.

**Is there a fix for CVE-2025-13002?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-13002 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-13002?** Check whether you run Farktor E-Commerce Package. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Farktor Software E-Commerce Package through version 27112025. The flaw stems from improper neutralization of user-supplied input during the generation of web pages (CWE-79). A remote, unauthenticated attacker can exploit this by sending specially crafted input to the application, which is then executed in the context of a victim's browser. While the CNA (TR-CERT) provides a CVSS score of 8.2 with no user interaction required, NVD's analysis suggests a score of 6.1 requiring user interaction. Successful exploitation can allow an attacker to execute arbitrary script code, potentially leading to session hijacking or unauthorized data modification.

## Affected products

- Farktor Software E-Commerce Services Inc. E-Commerce Package through 27112025

## Timeline

- 2026-02-12: disclosed
- 2026-02-12: advisory

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0063](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0063)
- [https://www.usom.gov.tr/bildirim/tr-26-0063](https://www.usom.gov.tr/bildirim/tr-26-0063)

## Related threats

- [Farktor Software E-Commerce Package auth bypass in user-controlled variables](https://junglewise.ai/threats/cve-2025-13004-farktor-software-e-commerce-package-auth-bypass-in-user)
- [Farktor Software E-Commerce Package SQL injection](https://junglewise.ai/threats/cve-2025-10969-farktor-software-e-commerce-package-sql-injection)