CVE-2026-11975 – Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interface

CVE ID :CVE-2026-11975

Published : June 17, 2026, 12:18 p.m. | 1 hour, 24 minutes ago

Description :Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw()

Severity: 6.2 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…