A reflected XSS flaw exists in the admin panel of Magento LTS under System → Import/Export → Dataflow − Profiles. An attacker who can craft a request that is processed by the import interface can inject arbitrary script into the page returned to the user. This can lead to security‑related consequences such as session hijacking, defacement or execution of malicious code in the victim’s browser. The weakness maps to CWE‑87: Improper Neutralization of Input During Web Page Generation.

The vulnerability affects the OpenMage community run of Magento LTS. All releases prior to 20.18.0 are susceptible.

The CVSS score for this issue is 5.3, indicating a moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an authenticated session with access to the admin area is required for exploitation; an attacker who gains such privileges can submit crafted import data to trigger the reflected XSS. Although not widely known to be exploited in the wild, the moderate score and lack of mitigation by default make it a noteworthy risk for sites that still run older OpenMage LTS versions.