ESLog inGet started free
Medium 5.4 CVSS 3.1 xipblog Published on 2026-08-28

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in…

CVECVE-2026-38725 GHSANo GHSA advisory
View at the source View JSON Last modified at the source: 2026-09-09

Description

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting in Stored Cross-Site Scripting (XSS). When an administrator reviews comments in the back office, the payload executes with admin-level session context, leading to full store compromise.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · secondary
Medium 5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vectorNetwork
ComplexityLow
Privileges requiredLow
User interactionRequired
ScopeChanged
ConfidentialityLow
IntegrityLow
AvailabilityNone

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: xipblog
All xipblog advisories (2)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2023-27847 SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges… xipblog Critical 9.8 ≤ 2.0.1 2023-03-27 No

Do you use the xipblog module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected