CVE-2026-14634 Cross-site scripting in Ecommerce-CodeIgniter-Bootstrap
Remote attackers can inject malicious scripts via the User-Agent header in the Subscribed Emails Admin page, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-14634?
CVE-2026-14634 is a medium-severity cross-site scripting vulnerability in kirilkirkov Ecommerce-CodeIgniter-Bootstrap, published on 4 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa949e94557246414db0130e01394517. This vulnerability affects the function checkForPostRequests of the file application/core/MY_Controller.php of the component Subscribed Emails Admin Page. Such manipulation of the argument User-Agent leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The name of the patch is 23105f25dadf57b4314fc015a63a7c6e910c89df. It is advisable to implement a patch to correct this issue.
Which versions are affected by CVE-2026-14634?
How do I fix CVE-2026-14634?
No fix has been published for CVE-2026-14634 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-14634 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-14634 exists.
Sources
Also known as GHSA-r56h-8xf5-wf6h, GHSA-v69c-5xg5-q7r8.