ESLog inGet started free
Critical 9.8 CVSS 3.1 advancedpopupcreator Published on 2026-02-13

A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in version 1.2.7) allows…

CVECVE-2025-69633 GHSANo GHSA advisory
View at the source View JSON Last modified at the source: 2026-06-17

Description

A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in version 1.2.7) allows remote unauthenticated attackers to execute arbitrary SQL queries via the fromController parameter in the popup controller. The parameter is passed unsanitized to SQL queries in classes/AdvancedPopup.php (getPopups() and updateVisits() functions).

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · secondary
Critical 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vectorNetwork
ComplexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: advancedpopupcreator
All advancedpopupcreator advisories (2)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2023-27032 Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the… advancedpopupcreator Critical 9.8 ≥ 1.1.21 < 1.1.25 2023-04-12 Yes

Do you use the advancedpopupcreator module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected