CVE-2026-44212: PrestaShop has a stored XSS executable in customer service view
Impact This is a stored Cross-site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover.
Published May 8, 2026
Affected packages
prestashop/prestashop
- Ecosystem
- Composer (PHP)
- Affected
- < 8.2.6
- Fixed in
- 8.2.6
- Check
composer show prestashop/prestashop
prestashop/prestashop
- Ecosystem
- Composer (PHP)
- Affected
- >= 9.0.0, < 9.1.1
- Fixed in
- 9.1.1
- Check
composer show prestashop/prestashop
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
This is a stored Cross-site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view.
An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover.
Patches
Patched in PrestaShop 8.2.6 and 9.1.1.
Workarounds
None.
Resources
- Reported by Savio at Doyensec (
[email protected]) in collaboration with Anthropic Research.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology