Medium severity5.4NVD Advisory· Published Oct 3, 2026

CVE-2026-104479

Description

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping, causing it to execute in the site origin for any visitor viewing the listing.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mindstellar/shopclassllm-create
Range: <6.2.0

Patches

Vulnerability mechanics

References

github.com/mindstellar/shopclass/commit/c196f70906522c9b9172c24f1b42cd0a02357422nvd
www.vulncheck.com/advisories/shopclass-before-6.2.0-stored-xss-via-listing-description-fieldnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000