Description
The public consent endpoint of JTL-Shop accepts arbitrary
consent names from unauthenticated visitors without validating
them against the configured consent items. These names are stored in the consent
statistics and rendered without output encoding in the administration
backend. An unauthenticated remote attacker can thereby inject script code that
is executed in the browser session of an administrator viewing the consent
statistics page, allowing actions to be performed with the administrator's
privileges.
Published: 2026-10-14
Score: 8.6 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Manual patches will be published for older unsupported versions (5.4.x and 5.5.x).

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.
Title Stored XSS Vulnerability in JTL-Shop
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: ENISA

Published:

Updated: 2026-10-14T10:23:29.429Z

Reserved: 2026-10-01T14:12:50.876Z

Link: CVE-2026-103904

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses