CVE-2025-27400: OpenMage Magento LTS Stored XSS Vulnerability in Theme Config Fields
Summary
CVE-2025-27400: Magento LTS vulnerable to stored XSS in theme config fields. Affects openmage/magento-lts versions < 20.12.3. Fixed in 20.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenMage Magento LTS is an open-source e-commerce platform that allows users to create and manage online stores. It provides a robust set of features for product management, customer management, and order processing. However, like many web applications, it is susceptible to security vulnerabilities. One such vulnerability is a stored cross-site scripting (XSS) issue found in the theme configuration fields, which can potentially allow malicious users to execute scripts in the context of other authenticated admin users.
Vulnerability Detail
The vulnerability arises from the Design > Themes > Skin (Images / CSS) configuration field, which fails to properly sanitize input containing an end script tag. This oversight allows a malicious user with access to this configuration field to inject malicious scripts that can execute when other authenticated admin users access the admin panel. While the attack requires an admin user with configuration access, it poses a risk of impersonating other users and could lead to unauthorized actions within the admin panel.
How To Fix
Minimum fixed version
20.12.3
This is the first release that contains the fix.
composer require openmage/magento-lts:20.12.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Design > Themes > Skin configuration field to trusted admin users only. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The stored XSS vulnerability in OpenMage Magento LTS poses a risk to admin users who have access to the theme configuration fields. It is crucial to update to the patched version (20.12.3 or later) to mitigate this risk. Until then, restricting access to the affected fields can serve as a temporary measure.
See every vulnerability recorded for openmage/magento-lts →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then stored on the server and executed in the browser of other users.
Any admin user with access to the Design > Themes > Skin configuration field in OpenMage Magento LTS is potentially affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 2.9, indicating a low severity level.
If immediate updating is not possible, ensure that access to the vulnerable configuration field is limited to trusted users to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for openmage/magento-lts.
