CVE-2026-44212

CRITICAL EPSS 24.9%

Published May 14, 20261mo ago · Modified Jun 17, 20262w ago

9.3 CVSS 3.1

Critical

Published May 14, 2026 1mo ago

Last Modified Jun 17, 2026 2w ago

Description

PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover. This vulnerability is fixed in 8.2.6 and 9.1.1.

CVSS Details

Base Score

9.3

Exploitability

2.8

Impact

5.8

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Changed

Confidentiality High

Integrity High

Availability None

Threat Intelligence

EPSS Exploit Probability

24.9% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

References 1

github.com https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-w9f3-qc75-qgx9

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.