GitHub Advisoryadvisory · Packagist

GHSA-w9f3-qc75-qgx9 PrestaShop has a stored XSS executable in customer service view

CRITICAL Published 2026-05-08 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-44212
Ecosystem
Packagist
Packages
prestashop/prestashop
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2026-05-08

Affected packages

• Packagist prestashop/prestashop: < 8.2.6 → fixed in 8.2.6 • Packagist prestashop/prestashop: >= 9.0.0, < 9.1.1 → fixed in 9.1.1

Description

Impact This is a stored Cross-site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover. Patches Patched in PrestaShop 8.2.6 and 9.1.1. Workarounds None. Resources • Reported by Savio at Doyensec (`[email protected]`) in collaboration with Anthropic Research.

Related

Alias · CVE (1)

  • CVE-2026-44212 PrestaShop is an open source e-commerce web application. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References