---
id: CVE-2026-104479
title: >-
  Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability
  that allows self-registered non-admin users to inject scripts into item
  listing descriptions when frontend TinyMCE is enabled
summary: >-
  Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability
  that allows self-registered non-admin users to inject scripts into item
  listing descriptions when frontend TinyMCE is enabled. Attackers can submit
  malicious Jav…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: mindstellar
product: shopclass
affected:
  - shopclass < 6.2.0
published: '2026-10-03'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T00:16:36.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104479'
references:
  - url: 'https://github.com/mindstellar/shopclass'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mindstellar/shopclass/commit/c196f70906522c9b9172c24f1b42cd0a02357422
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/shopclass-before-6.2.0-stored-xss-via-listing-description-field
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-02T23:34:57.408Z'
---

## Overview

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping, causing it to execute in the site origin for any visitor viewing the listing.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.