Advisories · Technology

Thelia Core.

Every CVE that names Thelia Core among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-120248 CVE record

CVSS 4.6 Medium

Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads
- Thelia
- Thelia Core
- Cross-site scripting (XSS)
Not analysed yet 1 Nov 2026
CVE-2026-120206 CVE record

CVSS 5.9 Medium

Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
- Thelia
- Thelia Core
- Cross-site request forgery (CSRF)
Not analysed yet 31 Oct 2026
CVE-2026-120205 CVE record

CVSS 7.4 High

Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
- Thelia
- Thelia Core
- Cross-site scripting (XSS)
Not analysed yet 31 Oct 2026