Skip to content
OpenAdvisories
Critical · 9.3 Public exploit CVE-2026-44212 EUVD-2026-30481GHSA-w9f3-qc75-qgx9

PrestaShop: Stored XSS executable in customer service view

Published May 14, 2026 · Updated May 15, 2026 · Assigned by GitHub_M

Vendor: PrestaShop Product: PrestaShop Package: prestashop/prestashop Category: Web / CMS Ecosystem: Packagist

Description

PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover. This vulnerability is fixed in 8.2.6 and 9.1.1.

Affected products

VendorProductAffectedFixed
PrestaShop PrestaShop < 8.2.6, >= 9.0.0-alpha.1, < 9.1.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • fstivicic/prestashop17-security-patches ★ 0 · Nov 11, 2026

    Unofficial security backports for PrestaShop 1.7.8.11 (EOL). CVE-2026-44212, unauthenticated stored XSS to back-office takeover. Not affiliated with PrestaShop SA.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist prestashop/prestashop < 8.2.6 8.2.6 GHSA-w9f3-qc75-qgx9
Packagist prestashop/prestashop >= 9.0.0, < 9.1.1 9.1.1 GHSA-w9f3-qc75-qgx9

References