# CVE-2026-14633: kirilkirkov Ecommerce-CodeIgniter-Bootstrap stored XSS in hidden REST API

Source: https://junglewise.ai/threats/cve-2026-14633-kirilkirkov-ecommerce-codeigniter-bootstrap-stored-xss-in-hidden  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-04. Updated: 2026-07-04  
License: CC BY 4.0 with a link back

CVE-2026-14633 · Severity: medium · CVSS 4.3 · Published 2026-07-04

A vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap platform, an online store solution. An unauthenticated attacker can use a hidden programming interface (API) to create unauthorized product listings containing malicious scripts. When a customer or administrator views these products, the scripts execute in their browser, potentially leading to account takeover, data theft, or website defacement.

Technologies: [Kirilkirkov Ecommerce-CodeIgniter-Bootstrap](https://junglewise.ai/threats/technologies/ecommerce-codeigniter-bootstrap). Vendors: [Kirilkirkov](https://junglewise.ai/threats/vendors/kirilkirkov).

## Quick answers

**Is CVE-2026-14633 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14633 being exploited in the wild.

**How severe is CVE-2026-14633?** Medium severity, with a CVSS score of 4.3, published 4 July 2026.

**Which products and versions are affected?** Kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 49b20f53de2b7ec34e920b11c863f1491d911a04.

**Is there a fix for CVE-2026-14633?** A patch was published on 2026-05-20: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14633 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-14633?** Check whether you run Kirilkirkov Ecommerce-CodeIgniter-Bootstrap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Ecommerce-CodeIgniter-Bootstrap up to commit 49b20f5. The root cause is two-fold: first, the REST API endpoint '/index.php/api/product/set' is exposed without authentication (CWE-306) due to 'rest_auth' being disabled in the configuration. Second, the application fails to sanitize or encode the 'title' and 'description' arguments before storing them and subsequently rendering them in frontend templates (CWE-79). A remote, unauthenticated attacker can send a POST request to the hidden API to inject malicious JavaScript. The script executes when a victim views the affected product page. A patch has been released in commit d9785f9 which implements session-based authentication checks and HTML output encoding.

## Affected products

- kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 49b20f53de2b7ec34e920b11c863f1491d911a04

## Timeline

- 2026-05-20: patched: Fix committed to repository
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-07-04: disclosed: NVD publication date

## References

- [https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/](https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/)
- [https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d9785f995da77bdc62fb2d34bad5f7a162c9ad23](https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d9785f995da77bdc62fb2d34bad5f7a162c9ad23)
- [https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-8q62-q8qx-j49g](https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-8q62-q8qx-j49g)
- [https://vuldb.com/cve/CVE-2026-14633](https://vuldb.com/cve/CVE-2026-14633)
- [https://vuldb.com/submit/845903](https://vuldb.com/submit/845903)
- [https://vuldb.com/vuln/376148](https://vuldb.com/vuln/376148)
- [https://vuldb.com/vuln/376148/cti](https://vuldb.com/vuln/376148/cti)

## Related threats

- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap deserialization in ShoppingCart](https://junglewise.ai/threats/cve-2026-14637-kirilkirkov-ecommerce-codeigniter-bootstrap-deserialization-in)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap path traversal in Vendor Image Manager](https://junglewise.ai/threats/cve-2026-14636-kirilkirkov-ecommerce-codeigniter-bootstrap-path-traversal-in)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap path traversal in Vendor Multi-Image Endpoint](https://junglewise.ai/threats/cve-2026-14635-kirilkirkov-ecommerce-codeigniter-bootstrap-path-traversal-in)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap stored XSS in Admin Page](https://junglewise.ai/threats/cve-2026-14634-kirilkirkov-ecommerce-codeigniter-bootstrap-stored-xss-in-admin)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap Open Redirect in MY_Controller](https://junglewise.ai/threats/cve-2026-14632-kirilkirkov-ecommerce-codeigniter-bootstrap-open-redirect-in-my)