Medium 5.4 CVSS 3.1 ps_emailsubscription Published on 2021-03-31

Potential XSS injection in the newsletter conditions field

CVECVE-2021-21418 GHSAGHSA-vwfx-hh3w-fj99

View at the source View JSON Last modified at the source: 2026-06-17

Description

Potential XSS injection in the newsletter conditions field

An employee can inject javascript in the newsletter condition field that will then be executed on the front office

The issue has been fixed in 2.6.1

Original text by NVD (NIST), public domain.

Source: security-advisories@github.com · secondary

Medium 5.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vectorNetwork

ComplexityLow

Privileges requiredLow

User interactionRequired

ScopeUnchanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

Write to the PrestaShop core security team:

Same module: ps_emailsubscription

IDAdvisoryComponentSeverityAffected versionsPublishedFix

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.