GHSA-mcfc-67vm-j568
Magento Cross-Site Scripting (XSS) vulnerability
Magento Commerce and Open Source 2.2.6 and 2.1.15 contain multiple security enhancements that help close Cross-Site Scripting (XSS) and other vulnerabilities.
What each source reports
GitHub Advisories No score
Magento Cross-Site Scripting (XSS) vulnerability
Magento Commerce and Open Source 2.2.6 and 2.1.15 contain multiple security enhancements that help close Cross-Site Scripting (XSS) and other vulnerabilities.
- Record
GHSA-mcfc-67vm-j568- Updated
- 2026-11-02
OSV No score
Magento Cross-Site Scripting (XSS) vulnerability
Magento Commerce and Open Source 2.2.6 and 2.1.15 contain multiple security enhancements that help close Cross-Site Scripting (XSS) and other vulnerabilities.
- Record
GHSA-mcfc-67vm-j568- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist |
2.1 up to 2.1.15 | 2.1.15 |
magento/community-editionPackagist |
2.2 up to 2.2.6 | 2.2.6 |
magento/community-editionPackagist |
2.1 up to 2.1.15, plus listed versions 2.1.02.1.0-rc12.1.0-rc22.1.0-rc32.1.1 Show 13 moreShow less2.1.102.1.112.1.122.1.132.1.142.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.9 |
2.1.15 |
magento/community-editionPackagist |
2.2 up to 2.2.6, plus listed versions 2.2.02.2.12.2.22.2.32.2.42.2.5 |
2.2.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-mcfc-67vm-j568 is a vulnerability with no CVSS score yet in magento/community-edition, published May 15, 2024. No source lists public exploit code. Fixed in magento/community-edition 2.1.15.