The vulnerability stems from the Smarty templates address.html and address‑update.html in Thelia 2.6.0, which do not properly escape double quotes in the “next” parameter. This is a CWE-79: Improper Neutralization of Input During Web Page Generation (Cross‑Site Scripting) flaw. When an authenticated user opens a crafted URL containing attacker‑controlled JavaScript, the script is reflected unescaped into the page and executes in the user’s browser. This allows the attacker to run arbitrary JavaScript in the context of the authenticated session, potentially stealing session cookies, hijacking the session, or performing actions on behalf of the user.

The affected product is Thelia version 2.6.0; the flaw exists in the listed Smarty templates and affects any deployment running that exact release. If later releases contain the same templates without the fix, they would also be vulnerable, so any Thelia installation running the vulnerable files should be assessed.

The defect is a reflected XSS that requires an attacker to lure an authenticated user to click a malicious link, so the attack vector is likely phishing or social engineering. The CVSS score of 6.1 and an EPSS score of < 1% indicate moderate severity and a low probability of exploitation; the vulnerability is not listed in the CISA KEV catalog, but the impact on confidentiality, integrity, and availability is significant because it grants the attacker the same privileges as the authenticated user. Exploitation is straightforward for an attacker who can deliver the malicious link, but it relies on user interaction, which reduces the likelihood of widespread automated exploitation.