Medium severityNVD Advisory· Published Oct 9, 2026

CVE-2026-4264

Description

Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the 'search' parameter, they are displayed insecurely in the HTML response, allowing for the arbitrary execution of JavaScript code in the victim's browser.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Beetiendainferred
Range: latest
Package: https://wordpress.org/plugins/beetienda
BeeTienda/BeeTiendallm-create
Range: latest demo version

Patches

Vulnerability mechanics

References

www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-beetienda-ecommerce-platformnvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000