Executive brief
Magento LTS vulnerable to stored XSS in theme config fields
Affected products
- Packagist openmage/magento-lts
Junglewise Threat Intelligence
CVE-2025-27400: Magento LTS vulnerable to stored XSS in theme config fields
CVE-2025-27400 · Severity: low · CVSS 3.1 · Published 2025-03-03
Technologies: openmage/magento-lts (Packagist). Vendors: Packagist.
Related threats
- OpenMage Magento LTS reflected XSS in Dataflow Profiles
- OpenMage Magento LTS open redirect in stockAction controller
- OpenMage Magento LTS predictable API session ID generation
- OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
- OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure