nopCommerce Cross-Site Scripting Vulnerability in Currencies Functionality

A stored cross-site scripting vulnerability has been identified in nopCommerce version 4.90.0. This issue arises within the Currencies functionality, specifically in the 'Custom formatting' input field. Once a malicious payload is saved in this field, the XSS vulnerability can be triggered by visiting the Bestsellers page, the 'Sales' > 'Orders' section, or by viewing a product through the shop application.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, navigate to 'Configuration' and then 'Currencies'. Edit any currency and enter a payload into the 'Custom formatting' input field. After saving, the payload will be executed when visiting the Bestsellers page, the 'Sales' > 'Orders' section, or when viewing a product in the shop application.