Medium 6.1 CVSS 3.1 fieldpopupnewsletter Published on 2023-09-08

FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at…

CVECVE-2023-39676 GHSANo GHSA advisory

View at the source View JSON Last modified at the source: 2026-06-17

Description

FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: nvd@nist.gov · primary

Medium 6.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vectorNetwork

ComplexityLow

Privileges requiredNone

User interactionRequired

ScopeChanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

References

Exploitblog.sorcery.ie
https://blog.sorcery.ie/posts/fieldpopupnewsletter_xss/
Not Applicablesorcery.ie
https://sorcery.ie
Productthemeforest.net
https://themeforest.net/user/fieldthemes
Third Party Advisorysecurity.friendsofpresta.org
https://security.friendsofpresta.org/modules/2023/09/07/fieldpopupnewsletter.html

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Do you use the fieldpopupnewsletter module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.

Check if my shop is affected