CVE-2025-1746: OpenCart Cross-Site Scripting Vulnerability in Versions Prior to 4.1.0
Summary
CVE-2025-1746: Cross-Site Scripting vulnerability in OpenCart. Affects opencart versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenCart is a popular open-source e-commerce platform that enables users to create and manage online stores. It offers a range of features including product management, order processing, and customer management. However, like many web applications, it is susceptible to security vulnerabilities, which can compromise user data and the integrity of the application.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability identified as CVE-2025-1746 affects OpenCart versions prior to 4.1.0. This vulnerability allows attackers to inject malicious JavaScript code into the application, which can be executed in the browser of users who visit a compromised URL. The attack can occur through the '/product/search' endpoint, where an attacker can craft a malicious link. If a victim clicks on this link, sensitive information such as session cookies can be stolen, or actions can be performed on behalf of the user without their consent.
How To Fix
Minimum fixed version
4.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization on the '/product/search' endpoint to mitigate the risk of XSS attacks. This can be done by encoding user inputs and ensuring that any output is properly escaped before being rendered in the browser.
Conclusion
The Cross-Site Scripting vulnerability CVE-2025-1746 poses a significant risk to users of OpenCart versions prior to 4.1.0. It is crucial for users to update their installations to the latest version to protect against potential attacks. Implementing input validation can also help mitigate risks until an update is applied.
See every vulnerability recorded for opencart →
FAQ
CVE-2025-1746 is a Cross-Site Scripting vulnerability in OpenCart that allows attackers to execute malicious JavaScript in the victim's browser.
OpenCart versions prior to 4.1.0 are affected by this vulnerability.
Attackers can steal sensitive user data, such as session cookies, or perform actions on behalf of the user.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You can update OpenCart to version 4.1.0 or later by downloading the latest version from the official website or using a package manager.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencart.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
