CVE-2026-4378
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The E-Commerce Pack by Akilli Ticaret Software Technologies Ltd. is vulnerable to Stored Cross-Site Scripting due to improper neutralization of input during web page generation. The issue affects versions from 4.5.001 through 28082026. The vendor was contacted but did not respond.
Risk Assessment
An attacker can inject malicious scripts that execute in users' browsers, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Since the vendor did not respond, consider temporary measures such as a Web Application Firewall (WAF) filtering requests and monitoring logs for suspicious activity. If possible, restrict access to the admin panel.
Other vulnerabilities in E-Commerce Pack
See all- CVE-2026-5218Medium
XSS vulnerability in Softtr Informatics E-Commerce Pack due to improper neutralization of script-related HTML tags. Allows Cross-Site Scripting attacks.
- CVE-2026-5219High
Softtr Information Technology Trade Ltd. Co. E-Commerce Pack before version 5.03.01.49 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 through 28082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.