Critical severity9.3GHSA Advisory· Published May 14, 2026· Updated May 15, 2026
CVE-2026-44212
CVE-2026-44212
Description
PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover. This vulnerability is fixed in 8.2.6 and 9.1.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
prestashop/prestashopPackagist | < 8.2.6 | 8.2.6 |
prestashop/prestashopPackagist | >= 9.0.0, < 9.1.1 | 9.1.1 |
Affected products
1- Range: >= 9.0.0, < 9.1.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.