Medium severity · published Nov 6, 2025
CVE-2025-64174
OpenMage is vulnerable to XSS in Admin Notifications
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin with direct database access or the admin notification feed source to inject malicious scripts into vulnerable fields. Unescaped translation strings and URLs are printed into contexts inside app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php. A malicious translation or polluted data can inject script. This issue is fixed in version 20.16.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
magento-lts · OpenMage
< 20.16.0 · source: vendor
MA
Magento · Openmage
before 20.16.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64174
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-64174
Patch
https://github.com/OpenMage/magento-lts/commit/9d604f5489851c54a96fca31b0e13c414b0fb20a
Exploit
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-qv78-c8hc-438r
More from magento-lts
9.3
CVE-2026-42155
Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs
8.8
CVE-2026-40488
OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
8.1
CVE-2026-25524
OpenMage LTS's Phar Deserialization leads to Remote Code Execution
6.1
CVE-2026-42207
Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts
5.4
CVE-2026-40098
OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant