Unknown · Nopcommerce · CVE-2022-28448
**Name of the Vulnerable Software and Affected Versions**
nopCommerce version 4.50.1
**Description**
The issue allows an attacker, with the role of a customer, to inject JavaScript code into the `First name` or `Last name` fields at Customer Info, enabling Cross Site Scripting (XSS) attacks.
**Recommendations**
For nopCommerce version 4.50.1, as a temporary workaround, consider restricting the input for `First name` and `Last name` fields to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.