CVE-2025-47289 is a medium severity stored cross-site scripting flaw (CVSS 6.3) in CE Phoenix, an open-source eCommerce platform. The testimonial description field accepts script, and session cookies lack the HttpOnly flag. It affects versions 1.0.9.9 through 1.1.0.2 and is fixed in version 1.1.0.3, so upgrade and review any stored testimonials.
What's affected
The record and the GitHub advisory agree on the range: CE Phoenix versions 1.0.9.9 through 1.1.0.2. The advisory lists 1.1.0.3 as the patched version. The affected component is the testimonial submission and approval system.
The issue needs a human step. The shop owner has to approve the testimonial before it is shown to visitors. Only then does the stored content run in the browser of anyone who views the testimonial page.
How to check if you're exposed
Find your CE Phoenix version in the admin area or in the version file shipped with your install, then compare it with the range above. Anything from 1.0.9.9 up to and including 1.1.0.2 is affected.
You can also look at the testimonials already stored. Open the testimonials list in the admin panel and read the full text of pending and approved entries, looking for markup or script in the description.
grep -rn "HttpOnly" /var/www/your-shop/includes 2>/dev/null
That search only tells you whether your code sets the flag anywhere. The authoritative test is in the browser: open your shop, look at the cookies in the developer tools and see whether the session cookie is marked HttpOnly.
What to do now
- Upgrade CE Phoenix to 1.1.0.3 or later.
- Review existing testimonials, including approved ones, and delete anything suspicious.
- Before approving a testimonial, open and read the entire entry. The advisory notes the admin can approve with one click, without seeing the full content.
- Set the HttpOnly flag on session cookies so that page scripts cannot read them.
- Sign out admin sessions and rotate admin passwords if you find a bad testimonial that was approved.
Why it matters
Two weaknesses combine here. The first is stored cross-site scripting, CWE-79: user content is saved and later shown to other users without being neutralized. The second is a sensitive cookie without the HttpOnly flag, CWE-1004. Together they mean a script in a testimonial can read a session cookie, which the advisory says can lead to account takeover.
HttpOnly is a cheap defence. A cookie with that flag cannot be read by page JavaScript, so a cross-site scripting bug loses its easiest prize. It does not remove the XSS flaw, since script can still act inside the page, but it narrows the damage.
The medium score fits the conditions: a low privilege account, user interaction, and no change of scope. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list. The practical risk depends on whether a careless approval happens. Fix the code and fix the review habit.
Quick check
Does an attacker need an admin account?
No admin account is needed to submit a testimonial, but the shop owner must approve it for the script to run for visitors. The CVSS vector sets privileges required to low and user interaction to required.
Does setting HttpOnly alone fix this?
No. It protects the session cookie from being read by script, but the stored script flaw remains until you upgrade to 1.1.0.3.
To see which known issues sit in your own dependencies, run the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 18 October 2026.
