Authenticated back‑office staff with content‑upload permissions can store SVG or HTML files that the application serves inline. When a site administrator opens one of these files, the embedded script runs in the administrator’s session and exploits a flaw in the user‑creation component that trusts a client‑supplied role identifier. This allows the attacker to create a new administrator account with a chosen password, granting full access to customer data, orders, and system settings. The new account survives after the malicious file is removed, making the compromise persistent and potentially more damaging than a single session hijack. The weakness is a stored cross‑site scripting flaw (CWE‑79) coupled with improper privilege validation (CWE‑269).

Shopper Labs’ Shopper Headless e‑commerce Admin Panel. Versions before 2.10.1 in the 2.x line and before 3.0.0‑beta.3 in the 3.x prerelease line are affected. The problem is fixed in 2.10.1 and 3.0.0‑beta.3; earlier releases require remediation before using them in production.

The CVSS score of 8.7 indicates high severity. EPSS is not available, so no precise exploitation probability can be quoted, but the vulnerability is not included in the CISA KEV catalog. Exploitation requires an authenticated staff member to upload a malicious SVG or HTML file and an administrator to open the file in a browser. After opening, the attacker can create a new administrator account, giving persistent and full‑privilege access. The attack is therefore medium‑to‑high risk depending on the site’s administrative review practices; if admins routinely open uploaded content, the vulnerability could be exploited quickly.