CVE-2025-66572 — Loaded Commerce 6.6 Client-Side Template Injection (CSTI)
Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victi…
Published: 2025-12-04 · CVSS: 6.9 · CVSS 4.0
Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim's browser context when they visit a crafted URL.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7