Sign in
Deutsch English Español Polski
Critical

PrestaShop has a stored XSS executable in customer service view

  • Disclosed: 08.05.2026
  • Updated: 11.10.2026 10:22

Impact

This is a stored Cross-site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view.

An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover.

Patches

Patched in PrestaShop 8.2.6 and 9.1.1.

Workarounds

None.

Resources

  • Reported by Savio at Doyensec (anthropic@doyensec.com) in collaboration with Anthropic Research.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package prestashop/prestashop < 8.2.6, >= 9.0.0, < 9.1.1 8.2.6, 9.1.1
PrestaShop (core) prestashop/prestashop < 8.2.6, >= 9.0.0, < 9.1.1 8.2.6, 9.1.1

References

CVSS score 9.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness (CWE)
CWE-79
Platform
Composer, PrestaShop
Package
prestashop/prestashop
Disclosed
08.05.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-w9f3-qc75-qgx9 - CC BY 4.0

Vulnerability history: prestashop/prestashop

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (31) in the archive
Total entries
31
First → latest
12.2021 05.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 5
  • High 8
  • Medium 17
  • Low 1

Disclosures per year

Severity:
  1. PrestaShop has a stored XSS executable in customer service view this entry
    Critical · 9.3 CVE-2026-44212 < 8.2.6, >= 9.0.0, < 9.1.1 8.2.6, 9.1.1
  2. PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
    High · 7.6 CVE-2026-33673 >= 9.0.0-alpha.1, < 9.1.0, < 8.2.5 9.1.0, 8.2.5
  3. PrestaShop cross-site scripting via customer contact form in FO, through file upload
    Critical · 9.6 CVE-2024-34716 >= 8.1.0, < 8.1.6 8.1.6
  4. PrestaShop some attribute not escaped in Validate::isCleanHTML method
    High · 8.1 CVE-2024-21627 >= 8.0.0-beta.1, < 8.1.3, < 1.7.8.11 8.1.3, 1.7.8.11
  5. Possible XSS injection through Validate::isCleanHTML method
    High · 8.3 CVE-2023-39527 >= 8.1.0, < 8.1.1, >= 8.0.0, < 8.0.5, < 1.7.8.10 8.1.1, 8.0.5, 1.7.8.10
  6. [CVE-2023-39529][CVE-2023-39530] path traversal: file deletion in the backoffice
    High · 6.7 CVE-2023-39525 < 8.1.1 8.1.1
  7. Reading a file through path traversal & Remote Code Execution via unsafe deserialization
    Critical · 9.1 CVE-2023-39528 < 8.1.1 8.1.1
  8. Chain: SQL Injection (CWE-89) and Eval Injection (CWE-95)
    Critical · 9.8 CVE-2022-31181 >= 1.6.0.10, < 1.7.8.7 1.7.8.7
  9. PrestaShop PHP Object Injection
    High · 8.8 CVE-2018-20717 < 1.7.2.5 1.7.2.5
  10. SQL filter bypass leading to arbitrary write requests using SQL Manager [DEBATE RUNNING ABOUT SCORING FROM PS CORE]
    High · 8.8 CVE-2023-30839 >= 8.0.0, < 8.0.4, < 1.7.8.9 8.0.4, 1.7.8.9
  11. Possible XSS injection through Validate::isCleanHTML method
    High · 8.0 CVE-2023-30838 >= 8.0.0, < 8.0.4, < 1.7.8.9 8.0.4, 1.7.8.9
  12. Server Side Twig Template Injection
    Critical · 9.0 CVE-2022-21686 >= 1.7.0.0, < 1.7.8.3 1.7.8.3
  13. SQL injection in prestashop/prestashop
    High · 7.5 CVE-2021-43789 >= 1.7.5.0, < 1.7.8.2 1.7.8.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.