Executive brief
SimplCommerce, an open-source e-commerce platform, contains a security flaw that allows administrators to inject malicious scripts into news articles. An attacker with administrative access could use this to target other users, potentially leading to unauthorized actions or data theft when those users view the affected news content. This issue has been addressed in recent updates by implementing proper content sanitization.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SimplCommerce's NewsItemApiController due to improper neutralization of input in the ShortContent and FullContent fields. The application stores these fields without HTML sanitization and subsequently renders them unencoded using the @Html.Raw() method. An authenticated attacker with high privileges (administrator) can exploit this by submitting malicious scripts that execute in the context of any user viewing the news items. The vulnerability is resolved by integrating HtmlSanitizer in the controller, as seen in commit 6142d3b5.
Affected products
- SimplCommerce SimplCommerce prior to commit 6142d3b5
Timeline
- 2026-05-25: patched: Fix merged via pull request 1151
- 2026-06-17: disclosed: CVE assigned and published