[CRITICAL] Magneto contains stored XSS vulnerability

PKSA-rb7h-1s2b-4dwg CVE-2025-47110 GHSA-j934-vjh5-vf9r

Affected version: =2.4.6|>=2.4.6-p1,<2.4.6-p11|=2.4.5|=2.4.8|=2.4.7|<2.4.5-p13|>=2.4.7-beta1,<2.4.7-p6|>=2.4.8-beta1,<2.4.8-p1

Reported by:
GitHub

[HIGH] Magento Improper Access Control vulnerability

PKSA-858j-1s59-ycmj CVE-2022-34255 GHSA-x95x-f4g9-mm85

Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|>=2.3.0,<2.3.7-p4

Reported by:
GitHub

[HIGH] Magento Improper Authorization vulnerability

PKSA-4kq2-8xg5-xc5f CVE-2022-34256 GHSA-r7mm-grf3-5fjv

Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|>=2.3.0,<2.3.7-p4

Reported by:
GitHub

[MEDIUM] Magento stored Cross-Site Scripting (XSS) vulnerability

PKSA-8rxk-pq5k-p21j CVE-2022-34257 GHSA-rg7p-wmgj-f374

Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|>=2.3.0,<2.3.7-p4

Reported by:
GitHub

[MEDIUM] Magento stored Cross-Site Scripting (XSS) vulnerability

PKSA-48rk-jcyb-xpsd CVE-2022-34258 GHSA-5m55-g8pv-x8ww

Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|>=2.3.0,<2.3.7-p4

Reported by:
GitHub

[MEDIUM] Magento Improper Access Control vulnerability

PKSA-1w77-ttnz-wb1k CVE-2022-34259 GHSA-9wjf-94h3-r4rh

Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|>=2.3.0,<2.3.7-p4

Reported by:
GitHub

[CRITICAL] Magento XML Injection vulnerability in the Widgets Module

PKSA-ky72-2cr3-p8cw CVE-2022-34253 GHSA-cj7w-pm77-hvg6

Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|<2.3.7-p4

Reported by:
GitHub