Thelia before 3.1.0 contains a stored cross‑site scripting flaw in the ForSomeCustomers::getSummary() method that allows an unauthenticated attacker to embed arbitrary script code in a customer name. When an administrator later views coupons that use this coupon condition, the stored script executes in the administrator’s browser, enabling the attacker to steal CSRF tokens and create privileged administrator accounts.

All installations of Thelia and Thelia Core running versions earlier than 3.1.0 are impacted. This includes the 3.0.x series and any earlier releases that still rely on the original ForSomeCustomers implementation.

The vulnerability scores a CVSS of 7.4, indicating a high severity level. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Inferred attack vectors suggest that an attacker can register with a malicious customer name without authentication, and the payload will later execute when an administrator views a related coupon. The lack of authentication for the injection step and the automatic execution in an administrative context elevate the risk, especially for sites with publicly accessible registration forms.