CVE-2025-27400
Magento LTS vulnerable to stored XSS in theme config fields
Impact
As reported by [Aakash Adhikari](https://hackerone.com/dark_haxor), Github: @justlife4x4, the Design > Themes > Skin (Images / CSS) config field allows a Stored XSS when it contains an end script tag. ### Impact A malicious user with access to this configuration field could use a Stored XSS to affect other authenticated admin users in the admin panel. The attack requires an admin user with configuration access, so in practice, it is not very likely to be used for gaining elevated privileges, although it could theoretically be used to impersonate other users. 
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | openmage/magento-lts | < 20.12.3 | 20.12.3 |
Affected products
| Product | Affected versions |
|---|---|
| Backward Compatibility. | before 20.12.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea
- https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3
- https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668
- https://github.com/advisories/GHSA-5pxh-89cx-4668
- https://nvd.nist.gov/vuln/detail/CVE-2025-27400