A stored cross‑site scripting flaw exists in the public consent endpoint of JTL-Shop. Unauthenticated visitors may submit arbitrary consent names that are recorded in consent statistics and later rendered without output encoding in the administration backend. When an administrator views the consent statistics page, the injected script executes within the administrator’s browser context, enabling the attacker to perform privileged actions as that administrator.

The vulnerability affects JTL-Software GmbH JTL-Shop, specifically the unsupported older releases 5.4.x and 5.5.x. No other versions of the product are currently known to be impacted.

The flaw carries a CVSS score of 8.6. No EPSS score is currently available, and the issue is not listed in the CISA KEV catalog, which suggests it has not yet been widely exploited. The likely attack vector is a web application request to the consent endpoint from an unauthenticated user; the vulnerability is browser‑side, exploiting the administrator’s active session. Overall risk is high and timely remediation is recommended.