CVE-2019-7850: PRODSECBUG-2116: Stored cross-site scripting in the catalog events feature

unknown Affects magento/product-community-edition. Feed 2026.10.29.1, updated 2026-10-28; CVE published 2019.

PRODSECBUG-2116: Stored cross-site scripting in the catalog events feature

Package: magento/product-community-edition Composer
Affected versions: >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2
Fixed in: 2.1.18, 2.2.9, 2.3.2
Severity: unknown
Exploitation: not on CISA KEV · EPSS 6% (93.0th percentile)
Source: friendsofphp

References

https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13

NVD record magento/product-community-edition advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2024-34102 KEV critical Magento Open Source affected by an Improper Restriction of XML External Entity Reference ( same package: magento/product-community-edition
CVE-2019-7139 critical Magento 2 Community Edition SQLi Vulnerability same package: magento/product-community-edition
CVE-2019-8159 high Magento 2 Community Edition RCE Vulnerability same package: magento/product-community-edition
CVE-2019-7846 unknown PRODSECBUG-1513: Insufficient brute force protections on promo code entry same package: magento/product-community-edition
CVE-2019-8144 critical Magento 2 Community Edition RCE Vulnerability same package: magento/product-community-edition
CVE-2019-8135 critical Remote code execution via vulnerable Symphony dependecy injection same package: magento/product-community-edition