This vulnerability allows malicious code to be stored in Saleor rich‑text fields without server‑side sanitization, giving rise to stored cross‑site scripting. When the CMS renders these fields on dashboards or storefronts, injected scripts execute in the browsers of any user viewing the content, potentially stealing session or refresh tokens of privileged staff and compromising the backend. The weakness stems from improper HTML cleaning, corresponding to CWE‑79 and CWE‑83.

The flaw is present in the Saleor e‑commerce platform released between the start of version 3.0.0 and the following unpatched release points: 3.20.107, 3.21.42, and 3.22.26. It does not affect later releases 3.20.108, 3.21.43, or 3.22.27 and any subsequent versions. Affected deployments use the saleor:CPE base cpe:2.3:a:saleor:saleor.

The CVSS score of 7.2 indicates high risk; the EPSS score below 1% suggests the probability of a publicly available exploit is low, and it has not been listed in CISA’s KEV catalog. However, since the attack vector requires authenticated access to rich‑text editing privileges, the risk is limited to insiders or compromised accounts. The lack of mitigation means a successful attack could lead to credential theft and possible full‑control takeover of the platform.