CVE-2026-62990 - Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation
CVE ID :CVE-2026-62990 Published : Oct. 30, 2026, 9:17 p.m. | 44 minutes ago Description :Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can...