Medium 5.4 CVSS 3.1 ps_linklist Published on 2020-04-16

Stored XSS on back office edit page

CVECVE-2020-5266 GHSAGHSA-vr7g-vqp5-966j

View at the source View JSON Last modified at the source: 2026-06-17

Description

Stored XSS on back office edit page

Stored XSS when you create or edit a link list block with the title field.

The problem is fixed in 3.1.0

Original text by NVD (NIST), public domain.

Source: security-advisories@github.com · secondary

Medium 5.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vectorNetwork

ComplexityHigh

Privileges requiredLow

User interactionRequired

ScopeChanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

Write to the PrestaShop core security team:

Same module: ps_linklist

IDAdvisoryComponentSeverityAffected versionsPublishedFix

CVE-2020-5273 Stored XSS with custom URLs ps_linklist Medium 5.4 ≥ 3.0.0 < 3.1.0 2020-04-16 Yes

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.