ESLog inGet started free
Medium 6.1 CVSS 3.1 ndk_advanced_custom_fields Published on 2022-12-21

A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted…

CVECVE-2022-40841 GHSANo GHSA advisory
View at the source View JSON Last modified at the source: 2026-07-09

Description

A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloads injected into the "htmlNodes" parameter.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: nvd@nist.gov · primary
Medium 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vectorNetwork
ComplexityLow
Privileges requiredNone
User interactionRequired
ScopeChanged
ConfidentialityLow
IntegrityLow
AvailabilityNone

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: ndk_advanced_custom_fields
All ndk_advanced_custom_fields advisories (4)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2022-40842 ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php. ndk_advanced_custom_fields Critical 9.1 ≤ 3.5.0 2022-11-22 No
CVE-2022-40840 ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php. ndk_advanced_custom_fields Medium 6.1 ≤ 3.5.0 2022-11-02 No
CVE-2022-40839 A SQL injection vulnerability in the height and width parameter in NdkAdvancedCustomizationFields v3.5.0 allows… ndk_advanced_custom_fields High 7.5 = 3.5.0 2022-11-01 No

Do you use the ndk_advanced_custom_fields module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected