CVE-2023-39527
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
PrestaShop, as an open-source e-commerce application, is vulnerable to cross-site scripting (XSS) attacks through the `isCleanHTML` method in versions prior to 1.7.8.10, 8.0.5, and 8.1.1. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking. Organizations should be aware of the risks associated with outdated software versions.
Recommendation
It is recommended to update PrestaShop to versions 1.7.8.10, 8.0.5, or 8.1.1 to mitigate this vulnerability. A security audit of the application should also be conducted.
Other vulnerabilities in PrestaShop
See all- CVE-2023-45379Critical
In the "Rotator Img" module (posrotatorimg) for PrestaShop in versions at least up to 1.1 from PosThemes, an unauthenticated user can perform an SQL injection attack.
- CVE-2023-39526Critical
PrestaShop is an open source e-commerce application that is vulnerable to remote code execution through SQL injection and arbitrary file write in the back office in versions prior to 1.7.8.10, 8.0.5, and 8.1.1.
- CVE-2026-50986High
PrestaShop module totadministrativemandate versions below 1.8.1 are vulnerable to Cross-Site Request Forgery (CSRF). The payment validation controller lacks a CSRF token, allowing an attacker to confirm an order in awaiting status by hijacking a link.
- CVE-2026-14846Medium
In PrestaShop 8.2.1, a vulnerability exists due to improper sanitization of the 'Alias' parameter in the 'Update your address' function. An attacker can inject malicious expressions that are executed when data is exported using the 'Get my data in CSV' tool.
- CVE-2025-25692Medium
A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
- CVE-2025-25691Medium
A PHAR deserialization vulnerability in the /themes/import component of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
- CVE-2023-39529Medium
PrestaShop prior to version 8.1.1 allows for file deletion from the server using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue.
- CVE-2023-39528Medium
PrestaShop prior to version 8.1.1 contained the `displayAjaxEmailHTML` method that could be exploited to read any file on the server, potentially even outside of the project if the server is not correctly configured.
- CVE-2023-39525Medium
PrestaShop prior to version 8.1.1 has a vulnerability in the back office that allows file compromise through a path traversal attack. This can be achieved by replaying the import file deletion query with a specified file path that exploits this vulnerability.
- CVE-2023-39524Medium
PrestaShop prior to version 8.1.1 had an SQL injection vulnerability in the product search field on the product page in the admin panel. Version 8.1.1 includes a patch for this issue.
Original NVD description (English source)
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCleanHTML` method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.