TI-2021-22506 Aliases CVE-2021-47892 GHSA-gr7w-369c-5335

PEEL Shopping 9.3.0 - 'Comments/Special Instructions' Stored Cross-Site Scripting

MEDIUM 62CWE-79Published 2026-01-23 · Updated 2026-03-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the 'Comments / Special Instructions' parameter of the purchase page. Attackers can inject malicious JavaScript payloads that will execute when the page is refreshed, potentially allowing client-side script execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00261 18th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PEEL eCommerce	PEEL Shopping	9.3.0	—	No fix listed	CNA

PEEL Shopping VendorPEEL eCommerce Affected 9.3.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-47892
2026-10-03 Alias added: GHSA-gr7w-369c-5335

References

Exploit 1

ExploitDB-49574

Other 1

Archived Vendor Homepage

TI-2021-22511 PEEL Shopping 9.3.0 - 'address' Stored Cross-Site Scripting CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences