Vulnerability · Published Dec 11, 2025 · Assigned by VulnCheck
CVE-2024-58296CE Phoenix v1.0.8.20 Stored Cross-Site Scripting via admin/currencies.php
Medium 5.3
In plain English
A medium-severity cross-site scripting in CE Phoenix from PhoenixCart. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.4%top 69.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PhoenixCart | CE Phoenix | 1.0.8.20 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References
- ExploitDB-52015 exploit
- PhoenixCart Homepage product
- CE Phoenix Admin Panel Demo exploit, media-coverage
- SoftAculous CE Phoenix App Page product
- https://www.vulncheck.com/advisories/ce-phoenix-v-stored-cross-site-scripting-via-currencies-administration third-party-advisory