CVE-2025-66572: Loaded Commerce XSS Vulnerability

CVE-2025-66572 Overview

CVE-2025-66572 is a client-side template injection (CSTI) vulnerability in Loaded Commerce 6.6. The flaw resides in the search parameter, which fails to sanitize template expressions before rendering them in the browser. Unauthenticated attackers can craft a malicious URL that, when visited by a victim, executes arbitrary code in the victim's browser context. The issue is classified under CWE-78 in the NVD entry and enables session theft, credential harvesting, and drive-by attacks against store administrators and shoppers.

Critical Impact
Attackers can execute arbitrary script in a victim's browser session by delivering a crafted search URL, enabling account takeover of Loaded Commerce users.

Affected Products

Loaded Commerce 6.6
Deployments exposing the vulnerable search parameter to untrusted input
Storefronts using the default template rendering behavior

Discovery Timeline

2025-12-04 - CVE-2025-66572 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66572

Vulnerability Analysis

Loaded Commerce 6.6 reflects the value of the search query parameter into a page that is subsequently processed by a client-side template engine. Because the engine evaluates expressions embedded in the reflected content, attacker-controlled input becomes executable code within the browser. This differs from traditional reflected XSS in that even encoded HTML characters can be interpreted as template directives.

An attacker can construct a URL containing template syntax in the search field and lure a victim to click it. When the page renders, the injected expression executes with the privileges of the victim's session on the Loaded Commerce site. The result is arbitrary JavaScript execution in the origin of the storefront.

Public exploitation details are available in Exploit-DB #52084 and the VulnCheck Advisory #66.

Root Cause

The root cause is unsafe reflection of user-supplied input into a client-side template context without escaping or sandboxing. The application treats query string content as trusted template data rather than inert display text. No output encoding is applied before the expression evaluator processes the string.

Attack Vector

The attack is remote and unauthenticated. An attacker delivers a crafted link, typically through phishing, malvertising, or a compromised referrer. The victim's browser evaluates the template payload in the context of the Loaded Commerce origin, allowing cookie theft, session hijacking, or forced actions against the storefront.

No verified proof-of-concept code is reproduced here. Refer to the linked advisories for payload structure and technical details.

Detection Methods for CVE-2025-66572

Indicators of Compromise

Web server access logs containing search parameter values with template delimiters such as {{, }}, or [[
Outbound requests from client browsers to unknown domains immediately following a visit to a Loaded Commerce search URL
Unexpected session cookie transmission to third-party hosts referenced by storefront users
User reports of unexpected redirects or pop-ups from a Loaded Commerce storefront

Detection Strategies

Deploy web application firewall rules that flag template expression syntax inside HTTP query parameters targeting /search endpoints
Inspect referrer and query strings in HTTP logs for encoded variants of template delimiters, including %7B%7B and %5B%5B
Correlate anomalous JavaScript execution and DOM changes on storefront pages with recent search parameter values

Monitoring Recommendations

Enable detailed HTTP request logging on all Loaded Commerce front-end servers and forward logs to a centralized SIEM
Monitor for spikes in 200-response search requests originating from external referrers
Alert on session cookie exfiltration patterns using egress inspection tools

How to Mitigate CVE-2025-66572

Immediate Actions Required

Restrict access to the vulnerable search endpoint using a web application firewall until a vendor patch is applied
Strip or reject query parameter values containing template delimiters ({{, }}, [[, ]]) at the reverse proxy
Enforce a strict Content Security Policy that disallows inline script execution and unauthorized script sources
Notify administrators to avoid clicking untrusted links referencing the storefront domain

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Consult the Loaded Commerce homepage for release announcements and the VulnCheck advisory for updated remediation status.

Workarounds

Disable or remove the client-side template rendering on the search results page until an upstream fix is available
Sanitize the search parameter server-side by rejecting non-alphanumeric characters beyond a defined allowlist
Apply HTTP response headers Content-Security-Policy and X-XSS-Protection to reduce script execution scope

bash

# Example nginx rule to block template delimiters in the search parameter
location / {
    if ($arg_search ~* "(\{\{|\}\}|\[\[|\]\]|%7B%7B|%5B%5B)") {
        return 403;
    }
    proxy_pass http://loaded_commerce_backend;
}