Thelia Thelia Core

• CVE-2026-120248 Medium 4.8 Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads 0.2%
• CVE-2026-120206 Medium 5.9 Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions 0.1%
• CVE-2026-120205 High 8.0 Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name 0.3%