What is GHSA-fq85-g72w-pjwj?

GHSA-fq85-g72w-pjwj is a security advisory published by GitHub Security Advisories with Medium severity. Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit...

Which CVE IDs does GHSA-fq85-g72w-pjwj cover?

GHSA-fq85-g72w-pjwj covers the following CVE IDs: CVE-2026-11975. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-fq85-g72w-pjwjMedium

Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit...

Vendor

GitHub Security Advisories

Published

June 17, 2026

Last Modified

June 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-11975 →

📋 Description

Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw()

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-11975
https://github.com/simplcommerce/SimplCommerce/pull/1151
https://github.com/simplcommerce/SimplCommerce/commit/6142d3b5147899e0edb41663ae20183878ab39f7
https://github.com/advisories/GHSA-fq85-g72w-pjwj