TI-2024-14353 Aliases CVE-2024-21628 GHSA-vr7m-r9vm-m4wf

XSS can be stored in DB from "add a message form" in order detail page (FO)

LOW 27CWE-79Published 2024-01-02 · Updated 2024-11-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig's escape mechanism. In FO, the cross-site scripting attack is effective, but only impacts the customer sending it, or the customer session from which it was sent. This issue affects those who have a module fetching these messages from the DB and displaying it without escaping HTML. Version 8.1.3 contains a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00389 33rd percentileScored 2026-11-07

Fix Fixed PrestaShop (PrestaShop): 8.1.3prestashop/prestashop (Packagist): 8.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PrestaShop	PrestaShop	before 8.1.3	8.1.3	Patch available	CNA
—	prestashop/prestashop (Packagist)	before 8.1.3	8.1.3	Patch available	GHSA-vr7m-r9vm-m4wf

PrestaShop VendorPrestaShop Affected before 8.1.3 Fixed in 8.1.3 Patch available CNA
prestashop/prestashop (Packagist) Vendor— Affected before 8.1.3 Fixed in 8.1.3 Patch available GHSA-vr7m-r9vm-m4wf

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:prestashop:prestashop::::::::	before 8.1.3	Vulnerable	PrestaShop

cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:* Versions before 8.1.3 Vulnerable ·PrestaShop

Remediation

Fix · CNA PrestaShop (PrestaShop) Fixed in 8.1.3
Fix · GHSA-vr7m-r9vm-m4wf prestashop/prestashop (Packagist) Fixed in 8.1.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-21628
2026-10-03 Alias added: GHSA-vr7m-r9vm-m4wf

References

Patch 1

https://github.com/PrestaShop/PrestaShop/commit/c3d78b7e49f5fe49a9d07725c3174d005deaa597

Advisory 2

Other 2

TI-2024-27717 An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
TI-2024-23013 PrestaShop vulnerable to XSS via customer contact form in FO, through file upload CVSS 3.1CRITICAL 9.7
TI-2018-06367 modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu… CVSS 3.0CRITICAL 9.8
TI-2025-19098 A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0… CVSS 3.1MEDIUM 6.5
TI-2018-13560 PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to… CVSS 3.0CRITICAL 9.8
TI-2021-02206 The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the… CVSS 3.1CRITICAL 9.8

See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences