CE Phoenix v3.0.1 Stored Cross-Site Scripting via admin/currencies.php

Advisories

severity: medium
date: December 11, 2025
Affecting: CE Phoenix 1.0.8.20
CVE: CVE-2024-58296
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: ExploitDB-52015
PhoenixCart Homepage
SoftAculous CE Phoenix App Page
Credit: tmrswrr
Description: CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page.