Stored XSS in Froxlor via Malicious Theme Configuration

hello@craftedsignal.io — Tue, 13 Oct 2026 14:39:08 +0000

Froxlor versions from 2.0.0 up to, but not including, 2.3.14 are susceptible to a stored cross-site scripting (XSS) vulnerability. The vulnerability resides in the customer_index.php component, where the application fails to properly sanitize the theme configuration value submitted by authenticated customers. An attacker with standard customer access can inject malicious HTML and JavaScript payloads into their theme settings. When an administrator subsequently views the customer overview page with the 'Theme' column enabled, the payload executes within the context of the administrator's session. This allows the attacker to perform actions as the administrator, including creating new unauthorized administrator accounts or altering sensitive server configurations.

Impact

Successful exploitation allows for complete takeover of the administrative interface. Attackers can escalate privileges by creating new administrator accounts or modify underlying server settings, potentially leading to total system compromise. This vulnerability specifically affects environments hosting multiple customers where standard user accounts are accessible to the attacker.

Recommendation

Update Froxlor to version 2.3.14 or later immediately to patch the input sanitization flaw in customer_index.php.
Monitor administrative access logs for suspicious account creation or configuration changes performed shortly after viewing the customer overview module.
Restrict administrative access to the customer overview page until the patch is applied.

Froxlor (2.0.0-2.3.13) - CraftedSignal Threat Feed

Stored XSS in Froxlor via Malicious Theme Configuration

Impact

Recommendation