CVE-2026-36766 Details

A stored cross-site scripting vulnerability has been identified in Shopizer version 3.2.5. This issue resides in the XssHttpServletRequestWrapper class, where the filtering mechanism fails to sanitize JSON request bodies before they are processed by the server. As a result, attackers can inject malicious JavaScript payloads that are persisted in the database and executed in the context of the user when the affected data is accessed through the application's REST API.

To address this vulnerability, override the getInputStream() and getReader() methods in the XssHttpServletRequestWrapper class to include proper sanitization before the data is deserialized by Spring. Additionally, enable security response headers in the Spring Security configuration to mitigate XSS risks.