Stored cross‑site scripting vulnerabilities exist in Thelia version 2.6.0. User input is saved without proper encoding and later rendered in both the administrative interface and product pages, allowing an attacker to execute arbitrary JavaScript when the affected pages are viewed. This flaw can be used to hijack administrator sessions, steal credentials, or launch additional attacks against visitors.

The affected system is the Thelia content‑management platform, specifically version 2.6.0. The vulnerabilities appear in several administrative functions, including category creation and product creation, and propagate to the front‑end store pages.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation. Nevertheless, the stored XSS flaw allows code execution in the context of any user who views the compromised page. The likely attack vector involves an attacker with access to the admin area—either through credential compromise or social engineering—to create or modify content that injects malicious scripts. Because the vulnerability is present before any active exploitation data, the risk remains high for organizations still using v2.6.0 and should be addressed promptly.