Is CVE-2026-14634 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14634 being exploited in the wild.

How severe is CVE-2026-14634?

Medium severity, with a CVSS score of 4.3, published 4 July 2026.

Which products and versions are affected?

Kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa949e94557246414db0130e01394517.

Is there a fix for CVE-2026-14634?

A patch was published on 2026-05-20: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14634 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-14634?

Check whether you run Kirilkirkov Ecommerce-CodeIgniter-Bootstrap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14634: kirilkirkov Ecommerce-CodeIgniter-Bootstrap stored XSS in Admin Page

CVE-2026-14634 · Severity: medium · CVSS 4.3 · Published 2026-07-04

A security vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap shopping platform that allows unauthenticated users to attack the site's administrators. By submitting a newsletter subscription with a specially crafted web browser identifier (User-Agent), an attacker can inject malicious code into the administrative dashboard. When an administrator views the list of subscribed emails, this code executes in their browser, potentially allowing the attacker to steal session data or perform unauthorized actions with administrative privileges.

Technologies: Kirilkirkov Ecommerce-CodeIgniter-Bootstrap. Vendors: Kirilkirkov.

Quick answers

Is CVE-2026-14634 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14634 being exploited in the wild.
How severe is CVE-2026-14634?: Medium severity, with a CVSS score of 4.3, published 4 July 2026.
Which products and versions are affected?: Kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa949e94557246414db0130e01394517.
Is there a fix for CVE-2026-14634?: A patch was published on 2026-05-20: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14634 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-14634?: Check whether you run Kirilkirkov Ecommerce-CodeIgniter-Bootstrap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 213babd. The vulnerability is located in the `checkForPostRequests` function within `application/core/MY_Controller.php`, which handles newsletter subscriptions. The application captures the `HTTP_USER_AGENT` header from the request and stores it directly into the `subscribed.browser` database field without sanitization. When an administrator accesses the 'Subscribed Emails' management page (`/admin/emails`), the stored value is rendered in the view (`application/modules/admin/views/settings/emails.php`) without output encoding. An unauthenticated attacker can exploit this by sending a crafted User-Agent header during a subscription request, leading to arbitrary script execution in the context of an authenticated administrator. A patch is available in commit 23105f2 which implements HTML tag stripping and output encoding.

Affected products

kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa949e94557246414db0130e01394517

Timeline

2026-05-20: advisory: GitHub Security Advisory GHSA-v69c-5xg5-q7r8 published
2026-05-20: patched: Fix committed to repository
2026-07-04: disclosed: CVE-2026-14634 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.