Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-54266

CVE-2025-54266: Magento vulnerable to stored Cross-Site Scripting (XSS)

4.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-54266
GHSA ID
GHSA-pcrx-r49h-x2w5
EPSS Score
0.22229%
CWE
CWE-79
Published
10/14/2025
Updated
10/21/2025
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
magento/project-community-editioncomposer<= 2.0.2
magento/community-editioncomposer>= 2.4.9-alpha1, < 2.4.9-alpha32.4.9-alpha3
magento/community-editioncomposer>= 2.4.8-beta1, < 2.4.8-p32.4.8-p3
magento/community-editioncomposer>= 2.4.7-beta1, < 2.4.7-p82.4.7-p8
magento/community-editioncomposer< 2.4.6-p132.4.6-p13
magento/community-editioncomposer= 2.4.8
magento/community-editioncomposer= 2.4.7
magento/community-editioncomposer= 2.4.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

I have analyzed the provided vulnerability information but was unable to find the specific commits that introduced the patch for the stored XSS vulnerability (CVE-2025-54266). My attempts to compare the vulnerable and patched versions using their release tags did not reveal the individual security fix commits. Without the patch diff, I cannot confidently identify the vulnerable functions and provide the required evidence.

Therefore, I am returning an empty result.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

M***nto v*rsions *.*.*-*lp***, *.*.*-p*, *.*.*-p*, *.*.*-p**, *.*.*-p**, *.*.*-p** *n* **rli*r *r* *****t** *y * stor** *ross-Sit* S*riptin* (XSS) vuln*r**ility t**t *oul* ** **us** *y * *i**-privil**** *tt**k*r to inj**t m*li*ious s*ripts into vuln*

Reasoning

I **v* *n*lyz** t** provi*** vuln*r**ility in*orm*tion *ut w*s un**l* to *in* t** sp**i*i* *ommits t**t intro*u*** t** p*t** *or t** stor** XSS vuln*r**ility (*V*-****-*****). My *tt*mpts to *omp*r* t** vuln*r**l* *n* p*t**** v*rsions usin* t**ir r*l