CVE-2026-14633: Ecommerce-CodeIgniter-Bootstrap XSS Flaw

CVE-2026-14633 Overview

CVE-2026-14633 is a stored cross-site scripting (XSS) vulnerability in kirilkirkov/Ecommerce-CodeIgniter-Bootstrap up to commit 49b20f53de2b7ec34e920b11c863f1491d911a04. The flaw resides in the /index.php/api/product/set endpoint, described as a hidden REST API endpoint. Attackers can manipulate the title and description arguments to inject script content that later executes in the browsers of users viewing affected pages. The project uses a rolling release strategy, so no fixed version number is published. Maintainers addressed the issue in patch commit d9785f995da77bdc62fb2d34bad5f7a162c9ad23, which also introduces an authentication check on the endpoint. The exploit has been publicly disclosed.

Critical Impact
Unauthenticated attackers can persist attacker-controlled HTML and JavaScript into product metadata that is later rendered in page titles and Open Graph meta tags, resulting in stored XSS against site visitors and administrators.

Affected Products

kirilkirkov/Ecommerce-CodeIgniter-Bootstrap up to commit 49b20f53de2b7ec34e920b11c863f1491d911a04
Component: Hidden REST API Endpoint /index.php/api/product/set
Affected view template: application/views/templates/clothesshop/_parts/header.php

Discovery Timeline

2026-07-04 - CVE-2026-14633 published to the National Vulnerability Database (NVD)
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-14633

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. The set_post action in application/controllers/Api/Products.php accepted product data over the REST API without verifying that the caller was authenticated. Attackers could submit crafted title and description fields containing HTML or JavaScript. That input was persisted to the product store and later rendered by the storefront template header.php without output encoding. Because the injected payload runs in the browser context of any user visiting a product page, adversaries can hijack sessions, perform actions on behalf of authenticated administrators, or deliver secondary payloads.

Root Cause

Two issues combine to produce the flaw. First, the set_post handler lacked a session check, allowing anonymous callers to create products. Second, the storefront header template emitted $title and $description directly into the <title> element and og:title, og:description, and description meta tags using raw PHP short echo tags. Neither the API layer sanitized input nor the view layer escaped output.

Attack Vector

Exploitation is remote and requires no privileges. An attacker sends an HTTP POST to /index.php/api/product/set containing malicious markup in the title or description translation fields. The product is stored, and the payload executes whenever a visitor loads a page that renders the affected header template. User interaction is required only in the sense that a victim must load the poisoned page.

php

// Patch: application/controllers/Api/Products.php
// Added authentication guard on set_post()
public function set_post()
{
    if (!$this->session->userdata('logged_in')) {
        $this->response(['message' => 'Unauthorized'], REST_Controller::HTTP_UNAUTHORIZED);
        return;
    }
    $errors = [];
    $_POST['image'] = $this->uploadImage();
    if (!isset($_POST['translations']) || empty($_POST['translations'])) {
        // ...
    }
}
// Source: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d9785f995da77bdc62fb2d34bad5f7a162c9ad23

Detection Methods for CVE-2026-14633

Indicators of Compromise

POST requests to /index.php/api/product/set originating from unauthenticated sessions or unexpected IP ranges.
Product records whose title or description fields contain <script>, onerror=, onload=, javascript:, or encoded variants such as %3Cscript%3E.
Storefront pages returning HTTP 200 with unescaped <, >, or quote characters inside the <title> element or og:* meta tags.

Detection Strategies

Inspect web server access logs for POST /index.php/api/product/set events with anomalous User-Agent, no prior authentication cookie, or bulk creation patterns.
Run database queries across product tables to flag rows where translation columns match HTML-tag or event-handler regexes.
Diff currently deployed source against patch commit d9785f995da77bdc62fb2d34bad5f7a162c9ad23 to confirm the authentication check and htmlspecialchars wrappers are in place.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that detects XSS payloads on the /api/product/set route.
Alert on Content Security Policy (CSP) violation reports referencing inline script sources from storefront pages.
Track outbound requests from browsers rendering product pages to unexpected third-party domains, which may indicate active payload beaconing.

How to Mitigate CVE-2026-14633

Immediate Actions Required

Apply patch commit d9785f995da77bdc62fb2d34bad5f7a162c9ad23 from the GitHub Commit Details.
Audit the products table for existing entries containing HTML or script content in title and description fields, and sanitize or remove them.
Rotate administrator credentials and invalidate active sessions if evidence of exploitation exists.

Patch Information

The fix is published in the upstream repository under commit d9785f995da77bdc62fb2d34bad5f7a162c9ad23. It adds a logged_in session check to set_post() in application/controllers/Api/Products.php and wraps $title and $description output in htmlspecialchars($value, ENT_QUOTES, 'UTF-8') within application/views/templates/clothesshop/_parts/header.php. Details are also available in the GitHub Security Advisory GHSA-8q62-q8qx-j49g and the VulDB CVE Report.

Workarounds

Block or restrict access to /index.php/api/product/set at the reverse proxy or WAF until the patch is deployed.
Add server-side input validation that rejects HTML tags in product title and description fields.
Set a strict Content Security Policy that disallows inline scripts on storefront pages to limit payload execution.

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoint
location = /index.php/api/product/set {
    if ($http_cookie !~* "ci_session=") {
        return 401;
    }
    proxy_pass http://php_backend;
}