https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-65593.htmlhttps://patchthecve.com/cve/CVE-2025-65593.htmlTue, 13 Oct 2026 11:10:00 +0000HIGH 8.8: nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality.https://patchthecve.com/cve/CVE-2025-65592.htmlhttps://patchthecve.com/cve/CVE-2025-65592.htmlTue, 13 Oct 2026 11:10:00 +0000MEDIUM 6.1: nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages.https://patchthecve.com/cve/CVE-2025-65591.htmlhttps://patchthecve.com/cve/CVE-2025-65591.htmlTue, 13 Oct 2026 11:10:00 +0000MEDIUM 5.4: nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.https://patchthecve.com/cve/CVE-2025-65590.htmlhttps://patchthecve.com/cve/CVE-2025-65590.htmlTue, 13 Oct 2026 11:10:00 +0000MEDIUM 5.4: nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area.https://patchthecve.com/cve/CVE-2025-65589.htmlhttps://patchthecve.com/cve/CVE-2025-65589.htmlTue, 13 Oct 2026 11:10:00 +0000MEDIUM 6.1: nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality.https://patchthecve.com/cve/CVE-2021-42193.htmlhttps://patchthecve.com/cve/CVE-2021-42193.htmlSun, 05 Jul 2026 17:17:12 +0000MEDIUM 6.1: nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payload fires.https://patchthecve.com/cve/CVE-2024-58248.htmlhttps://patchthecve.com/cve/CVE-2024-58248.htmlWed, 17 Jun 2026 08:14:42 +0000LOW 3.5: nopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cards.https://patchthecve.com/cve/CVE-2024-38963.htmlhttps://patchthecve.com/cve/CVE-2024-38963.htmlWed, 17 Jun 2026 07:41:17 +0000MEDIUM 6.1: Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "AddProductReview.ReviewText" parameter(s) (Reviews) when creating a new review.