nopCommerce Stored Cross-Site Scripting Vulnerability in Blog Posts Functionality

A stored cross-site scripting vulnerability has been identified in nopCommerce version 4.90.0. This issue arises within the Blog posts feature of the Content Management area. Malicious HTML or JavaScript injected into the Body overview field of a blog post is saved on the server and executed when the blog page is accessed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the blog post.

Reproduction

To reproduce this vulnerability, log into the nopCommerce admin panel and navigate to the Content Management section. Select 'Blog posts' and create a new blog post or edit an existing one. In the Body overview field, insert malicious HTML or JavaScript. Once the post is saved, the injected script will execute when the blog page is visited.