prestashop/ps_contactinfo · Security
ps_contactinfo has a potential XSS due to usage of the nofilter tag in template
- GHSA ID
- GHSA-35pq-7pv2-2rfw
- CVE ID
- CVE-2025-24027
- Severity
- medium
- Published
- Updated
- CVSS
- 6.2 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H
- CVSS v3
- 6.2 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H
Description
Impact
This can not be exploited in a fresh install of PrestaShop, only shops made vulnerable by third party modules are concerned.
For example, if your shop has a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored XSS in FO.
Patches
The long term fix is to have all your modules maintained and updated. The fix on ps_contactinfo will keep formatted addresses from displaying an xss stored in the database.
Workarounds
none
References
none
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')