PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables

TRUNG BÌNH 5.4CVE-2026-33673 · GHSA-35pf-37c6-jxjv · Công bố 26/03/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-33673 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng prestashop/prestashop, prestashop (prestashop).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.27%, cao hơn 20.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 9.1.0, 8.2.5 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
prestashop/prestashop Packagist	`≥ 9.0.0-alpha.1, < 9.1.0< 8.2.5`	`9.1.08.2.5`
prestashop prestashop	`≥ 9.0.0, < 9.1.0< 8.2.5`	`9.1.08.2.5`

Mô tả

Impact

Multiple stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO: an attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates.

Patches

Patched on 8.2.5 and 9.1.0

Workarounds

None

References

None

Mô tả của NVD

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates. Versions 8.2.5 and 9.1.0 contain a fix. No known workarounds are available.