Read the docs
TI-2024-14352 Aliases CVE-2024-21627GHSA-xgpm-q3mq-46rq

Some attribute not escaped in Validate::isCleanHTML method

Priority LOW 38CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00523 44th percentileScored 2026-11-07
Fix Fixed PrestaShop (PrestaShop): 8.1.3, 1.7.8.11prestashop/prestashop (Packagist): 8.1.3, 1.7.8.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PrestaShopPrestaShop8.0.0 to before 8.1.3; before 1.7.8.118.1.3, 1.7.8.11Patch availableCNA
—prestashop/prestashop (Packagist)8.0.0-beta.1 to before 8.1.38.1.3Patch availableGHSA-xgpm-q3mq-46rq
—prestashop/prestashop (Packagist)before 1.7.8.111.7.8.11Patch availableGHSA-xgpm-q3mq-46rq
  • PrestaShop VendorPrestaShop Affected 8.0.0 to before 8.1.3; before 1.7.8.11 Fixed in 8.1.3, 1.7.8.11 Patch available CNA
  • prestashop/prestashop (Packagist) Vendor— Affected 8.0.0-beta.1 to before 8.1.3 Fixed in 8.1.3 Patch available GHSA-xgpm-q3mq-46rq
  • prestashop/prestashop (Packagist) Vendor— Affected before 1.7.8.11 Fixed in 1.7.8.11 Patch available GHSA-xgpm-q3mq-46rq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*before 1.7.8.11; 8.0.0 to before 8.1.3VulnerablePrestaShop
  • cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:* Versions before 1.7.8.11; 8.0.0 to before 8.1.3 Vulnerable ·PrestaShop

Remediation

  • Fix · CNA PrestaShop (PrestaShop) Fixed in 8.1.3, 1.7.8.11
  • Fix · GHSA-xgpm-q3mq-46rq prestashop/prestashop (Packagist) Fixed in 8.1.3 Advisory →
  • Fix · GHSA-xgpm-q3mq-46rq prestashop/prestashop (Packagist) Fixed in 1.7.8.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21627
  2. 2026-10-03 Alias added: GHSA-xgpm-q3mq-46rq

References

Patch 2

Advisory 2

Other 3

  • TI-2024-27717 An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
  • TI-2024-23013 PrestaShop vulnerable to XSS via customer contact form in FO, through file upload CVSS 3.1CRITICAL 9.7
  • TI-2018-06367 modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu… CVSS 3.0CRITICAL 9.8
  • TI-2025-19098 A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0… CVSS 3.1MEDIUM 6.5
  • TI-2018-13560 PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2021-02206 The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the… CVSS 3.1CRITICAL 9.8
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences