CVE-2025-27400: Magento vulnerable to stored XSS in theme config fields
Description
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.1 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.1 contain a patch for the issue.
Classification
CVE ID: CVE-2025-27400
CVSS Base Severity: LOW
CVSS Base Score: 2.9
CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Problem Types
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Affected Products
Vendor: OpenMage
Product: magento-lts
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.12% (probability of being exploited)
EPSS Percentile: 18.85% (scored less or equal to compared to others)
EPSS Date: 2025-03-29 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: partial
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2025-27400https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668
https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea
https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3
https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0