An authenticated user can inject malicious HTML or JavaScript that is persisted through entity names such as taxon or product names and rendered by the Sylius eCommerce Framework. The vulnerability arises from unsanitized output in Twig templates and JavaScript literal interpolation, allowing script execution in the context of any browser that views pages containing those entities. The weakness is a classic stored cross‑site scripting flaw, classified as CWE-79, which can lead to session hijacking, credential theft, defacement, or further exploitation of users who visit affected pages.

The issue affects the Sylius eCommerce Framework, which is built on Symfony. An attacker must be able to modify or create entity names (taxons, products, etc.) in the administrative interface. Vendors and product: Sylius:Sylius. Versions impacted cover all releases before the following patches: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above are safe.

The vulnerability carries a CVSS score of 4.8, indicating moderate severity. Its EPSS score is below 1%, suggesting low probability of widespread exploitation at present, and it is not listed in the CISA KEV catalog. However, because an attacker must be authenticated to inject payloads, the attack surface is limited to privileged users. Once injected, the script executes in the browsers of all users who view pages that render the compromised entity, allowing attackers to steal session cookies or hijack accounts. The official Fixes are available, so the risk drops to negligible once the system is updated.