Codazon Magento Themes are vulnerable to a reflected cross-site scripting attack that could allow unauthenticated actors to execute arbitrary code within the context of a victim's browser session.

This is a reflected cross-site scripting (XSS) vulnerability occurring via the cat parameter. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that this flaw is exploitable by an unauthenticated attacker, though it requires user interaction to execute.

Successful exploitation allows an attacker to execute malicious scripts in the victim's browser, potentially leading to session hijacking, unauthorized actions on behalf of the user, or the theft of sensitive information. With a CVSS score of 8.8, this vulnerability is classified as High severity, posing a significant risk to the integrity and confidentiality of user interactions within the Magento platform.

Immediate Action: Given the lack of a confirmed patch, administrators should contact Codazon support or monitor the vendor website for the release of a security update. Until a patch is available, restrict access to the affected themes or disable the vulnerable component if it is not critical to operations.

Proactive Monitoring: Review web server access logs for anomalous requests containing script-like patterns or encoded characters within the cat URL parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious XSS payloads targeting the cat parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security researcher's report hosted on GitHub.

The presence of a public proof-of-concept significantly elevates the risk of this high-severity vulnerability. Security teams must prioritize identifying if their specific Magento implementation utilizes the vulnerable Codazon Themes and apply vendor-provided updates as soon as they become available to prevent potential account takeovers or data theft.