CVE-2026-42458

MediumCVSS 5.3

Published: 15/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Magento Long Term Support (LTS) before 20.18.0 contains a reflected XSS vulnerability in the admin panel under System -> Import/Export -> Dataflow - Profiles. The vulnerability is fixed in 20.18.0.

Risk Assessment

An attacker could trick an administrator into clicking a crafted link, executing malicious script in their browser and potentially hijacking the admin session.

Recommendation

Update Magento LTS to version 20.18.0 or later. Additionally, verify links and avoid clicking unknown URLs in the admin panel.

Other vulnerabilities in Magento Long Term Support

CVE-2026-40098Medium
In Magento Long Term Support (LTS) prior to version 20.17.0, the shared wishlist add-to-cart endpoint authorizes access with a public sharing_code but loads the acted-on wishlist item by a separate global wishlist_item_id and never verifies that the item belongs to the shared wishlist referenced by that code. This lets an attacker import a victim's item into their own cart, copying the victim's private custom-option data, and if a file custom option is used, it can be elevated to cross-user file disclosure.

Original NVD description (English source)

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, there is a reflected XSS vulnerability under admin panel -> System -> Import/Export -> Dataflow - Profiles. This vulnerability is fixed in 20.18.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS