CVE-2021-33561

CVE-2021-33561 is a stored cross-site scripting (XSS) vulnerability affecting Shopizer versions prior to 2.17.0. An authenticated attacker can inject malicious web script or HTML into the customer_name field within various store administration forms, which is then stored in the database. When other administrative users access pages displaying this information, such as admin/customers/list.html, the injected code executes. This vulnerability has a CVSS score of 4.8 (Medium), indicating that while it requires high privileges and user interaction, it can lead to low impact on confidentiality and integrity. The attack vector is network-based, with low attack complexity. While there is no evidence of active exploitation (KEV: No), an exploit for this vulnerability (EDB-49901) is publicly available on ExploitDB. There is minimal community discussion or media coverage surrounding this CVE.