The stored cross‑site scripting vulnerability in Thelia allows authenticated back‑office administrators with store update permission to upload malicious SVG files as logo or banner. By embedding scripts in an onload attribute, the attacker can cause arbitrary JavaScript to run whenever the SVG is displayed in the /admin/store‑media/logo path or the public cache/images/store directory. This means that any visitor who views the site or any administrator who accesses the back‑office can have their browser context hijacked, leading to potential credential theft, session hijacking or defacement. The flaw is a classic example of CWE‑79, where input is not properly sanitized before rendering.

The vulnerability affects all installations of Thelia versions prior to 3.1.1, including the Core, Back‑office Default Twig Template, and the overall Thelia package. It applies to every instance where the default upload endpoints for store logo and banner files are used, regardless of the specific deployment or configuration, unless the image upload functionality has been independently hardened or disabled. No other vendors or products are listed as affected.

The CVSS base score of 4.6 indicates moderate severity; the exploit requires authenticated access to the back‑office with store update rights, which limits the attacker to users who have obtained or guessed those credentials. The EPSS score is not available, providing no current baseline for how frequently this type of attack is seen in the wild. The vulnerability is not listed in CISA KEV, implying no confirmed public exploitation yet. However, the attack path is straightforward for an authenticated attacker, and the potential impact on confidentiality and integrity of site users and administrators suggests that the vulnerability should be prioritized for remediation.