Executive brief
The xipblog module is a blog plugin for PrestaShop e-commerce stores that allows visitors to submit comments. A vulnerability in this plugin allows attackers to inject malicious JavaScript code through comment submissions without logging in. When a store administrator reviews these comments in the back office, the injected code executes with full administrator privileges, potentially enabling the attacker to steal session credentials, create unauthorized admin accounts, and gain complete control of the online store including access to customer data.
Technical details
This is a stored (persistent) Cross-Site Scripting (XSS) vulnerability in the xipblog module's ajax.php comment endpoint. The vulnerability exists because user input from the name and content parameters is stored in the database without HTML sanitization and later rendered in Smarty templates without output escaping. An unauthenticated attacker can submit a POST request to the comment submission endpoint with a malicious JavaScript payload embedded in the name or content parameter. No authentication or user interaction is required beyond the initial HTTP POST. When an administrator accesses the back office to review comments, the stored payload executes in the administrator's browser session, allowing session hijacking, admin account creation, and full store compromise. The vendor has not released a patch as of the disclosure date.
Affected products
- xpert-idea xipblog 2.0.1 and before
Timeline
- 2026-03-18: disclosed: Vulnerability discovered during source code audit
- 2026-04-22: other: CVE-2026-38725 assigned; vendor contacted via GitHub issue
- 2026-07-22: disclosed: Public disclosure after 90-day disclosure window with no vendor response
- 2026-08-28: other: Advisory published