CVE-2026-5218

MediumCVSS 4.3

Published: 27/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

XSS vulnerability in Softtr Informatics E-Commerce Pack due to improper neutralization of script-related HTML tags. Allows Cross-Site Scripting attacks.

Risk Assessment

Attackers can execute scripts in the victim's browser, potentially leading to session or data theft.

Recommendation

Update E-Commerce Pack to version 5.03.01.49 or later.

Other vulnerabilities in E-Commerce Pack

See all

CVE-2026-4378Medium
The E-Commerce Pack by Akilli Ticaret Software Technologies Ltd. is vulnerable to Stored Cross-Site Scripting due to improper neutralization of input during web page generation. The issue affects versions from 4.5.001 through 28082026. The vendor was contacted but did not respond.
CVE-2026-5219High
Softtr Information Technology Trade Ltd. Co. E-Commerce Pack before version 5.03.01.49 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user.

Original NVD description (English source)

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting (XSS). This issue affects E-Commerce Pack: before 5.03.01.49.