Skip to content

[GHSA-w9f3-qc75-qgx9] PrestaShop has a stored XSS executable in customer service view #7681

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
BaniMontoya wants to merge 1 commit into
base: BaniMontoya/advisory-improvement-7681
Choose a base branch
from
+3 −3
Open

[GHSA-w9f3-qc75-qgx9] PrestaShop has a stored XSS executable in customer service view #7681

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions advisories/github-reviewed/2026/05/GHSA-w9f3-qc75-qgx9/GHSA-w9f3-qc75-qgx9.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w9f3-qc75-qgx9",
"modified": "2026-05-08T16:54:22Z",
"modified": "2026-05-08T16:54:23Z",
"published": "2026-05-08T16:54:22Z",
"aliases": [
"CVE-2026-44212"
],
"summary": "PrestaShop has a stored XSS executable in customer service view",
"details": "### Impact\n\nThis is a **stored Cross-site Scripting (XSS)** vulnerability in the PrestaShop back-office Customer Service view.\n\nAn unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover.\n\n### Patches\n\nPatched in PrestaShop 8.2.6 and 9.1.1.\n\n### Workarounds\n\nNone.\n\n### Resources\n\n- Reported by Savio at Doyensec (`anthropic@doyensec.com`) in collaboration with Anthropic Research.",
"summary": "Credit Attribution Correction: Bani Montoya (B4N1) for original discovery",
"details": "### Impact\nThis is a stored Cross-site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view.\n\nAn unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover.\n\n### Patches\nPatched in PrestaShop 8.2.6 and 9.1.1.\n\n### Workarounds\nNone.\n\n### Resources\n- Reported by Savio at Doyensec (anthropic@doyensec.com) in collaboration with Anthropic Research.\n- Independently reported by Bani Montoya (B4N1) on March 30, 2026.",
"severity": [
{
"type": "CVSS_V3",
Expand Down