Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. (CVE-2026-103524)

Thelia v2.6.0 is affected by multiple stored XSS vulnerabilities due to improper handling of user input in administrative functions such as category and product creation. The input is stored without adequate sanitization or encoding and is rendered in the administrator interface and product pages, enabling attackers to execute arbitrary JavaScript code in the context of the affected pages.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the administrative interface or product pages, potentially leading to session hijacking, unauthorized actions, or defacement. This compromises the integrity and security of the administrative environment and possibly the storefront.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative interface access to trusted users only and consider additional input validation or output encoding controls if possible.