CVE-2016-10704: Magento

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503.

Affected products

• Magento Magento: before 2.0.10 (fixed in 2.0.10); from 2.1.0, before 2.1.2 (fixed in 2.1.2)

Published 2017-12-30. Last modified 2026-06-17.