Executive brief
PrestaShop, a popular e-commerce platform, is vulnerable to a security flaw that allows unauthorized individuals to take over administrative accounts. By submitting a specially crafted email address through the public 'Contact Us' form, an attacker can inject malicious code that runs when a store employee views the message. This can lead to the theft of employee login sessions and full control over the online store's management interface.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the PrestaShop back-office Customer Service view due to improper neutralization of input in the email address field. An unauthenticated attacker can submit a malicious payload through the public-facing 'Contact Us' form. This payload is stored in the database and subsequently executed in the browser of a back-office employee when they open the affected customer service thread. Because the vulnerability results in a scope change (S:C), it allows for session hijacking and full administrative takeover of the PrestaShop instance. The issue is resolved in versions 8.2.6 and 9.1.1.
Affected products
- PrestaShop PrestaShop < 8.2.6, < 9.1.1
Timeline
- 2026-05-04: advisory: Original GitHub security advisory published
- 2026-05-14: disclosed: CVE published to NVD