CVE-2026-5218
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
XSS vulnerability in Softtr Informatics E-Commerce Pack due to improper neutralization of script-related HTML tags. Allows Cross-Site Scripting attacks.
Risk Assessment
Attackers can execute scripts in the victim's browser, potentially leading to session or data theft.
Recommendation
Update E-Commerce Pack to version 5.03.01.49 or later.
Other vulnerabilities in E-Commerce Pack
See all- CVE-2026-12380Medium
Reflected XSS vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack due to improper input neutralization during web page generation. Affects versions through 2026-10-06.
- CVE-2026-11795Medium
An observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack before 5.03.01.54.
- CVE-2026-4378Medium
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 before 4.6.001.
- CVE-2026-5219High
Softtr Information Technology Trade Ltd. Co. E-Commerce Pack before version 5.03.01.49 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user.
Original NVD description (English source)
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting (XSS). This issue affects E-Commerce Pack: before 5.03.01.49.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS