Cross-Site Scripting (XSS) vulnerability in Prestashop
- Prestashop, 8.1.7 version.
INCIBE has coordinated the publication of a medium severity vulnerability affecting Prestashop - a free open source platform designed to create and manage e-commerce - which has been discovered by David Aparicio Salcedo.
This vulnerability has been assigned the following code, CVSS v3.1 base score, CVSS vector and vulnerability type CWE:
- CVE-2025-1230: CVSS v3.1: 4.8 | CVSS AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | CWE-79
The manufacturer is working on a fix for this vulnerability. It is recommended to update to the latest version available.
CVE-2025-1230: Stored Cross-Site Scripting (XSS) vulnerability in Prestashop 8.1.7, due to the lack of proper validation of user input through ‘/<admin_directory>/index.php’, affecting the ‘link’ parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
