CVE-2022-28448: Nopcommerce

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). An attacker (role customer) can inject javascript code to First name or Last name at Customer Info.

Affected products

• Nopcommerce Nopcommerce: version 4.50.1 only

Published 2022-04-26. Last modified 2026-06-17.