CVE-2026-62990 — Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation

According to the CERT title, same-origin SVG and HTML uploads in Shopper enable stored cross-site scripting (XSS) and persistent administrator creation.