CVE-2021-25963: Shuup

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.

Affected products

• Shuup Shuup: from 1.6.0, up to and including 2.10.8

Published 2021-09-30. Last modified 2026-06-17.