{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33673", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-23T16:34:59.930Z", "datePublished": "2026-03-26T21:41:13.249Z", "dateUpdated": "2026-03-27T20:27:40.683Z"}, "containers": {"cna": {"title": "PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-35pf-37c6-jxjv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-35pf-37c6-jxjv"}, {"name": "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.5"}, {"name": "https://github.com/PrestaShop/PrestaShop/releases/tag/9.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/PrestaShop/PrestaShop/releases/tag/9.1.0"}], "affected": [{"vendor": "PrestaShop", "product": "PrestaShop", "versions": [{"version": ">= 9.0.0-alpha.1, < 9.1.0", "status": "affected"}, {"version": "< 8.2.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T21:41:13.249Z"}, "descriptions": [{"lang": "en", "value": "PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates. Versions 8.2.5 and 9.1.0 contain a fix. No known workarounds are available."}], "source": {"advisory": "GHSA-35pf-37c6-jxjv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-27T20:27:27.559622Z", "id": "CVE-2026-33673", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T20:27:40.683Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33673", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-27T20:27:27.559622Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T20:27:37.247Z"}}], "cna": {"title": "PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables", "source": {"advisory": "GHSA-35pf-37c6-jxjv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "PrestaShop", "product": "PrestaShop", "versions": [{"status": "affected", "version": ">= 9.0.0-alpha.1, < 9.1.0"}, {"status": "affected", "version": "< 8.2.5"}]}], "references": [{"url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-35pf-37c6-jxjv", "name": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-35pf-37c6-jxjv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.5", "name": "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/PrestaShop/PrestaShop/releases/tag/9.1.0", "name": "https://github.com/PrestaShop/PrestaShop/releases/tag/9.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates. Versions 8.2.5 and 9.1.0 contain a fix. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T21:41:13.249Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33673", "state": "PUBLISHED", "dateUpdated": "2026-03-27T20:27:40.683Z", "dateReserved": "2026-03-23T16:34:59.930Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T21:41:13.249Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates. Versions 8.2.5 and 9.1.0 contain a fix. No known workarounds are available."}], "id": "CVE-2026-33673", "lastModified": "2026-03-26T22:16:30.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 6.0, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-03-26T22:16:30.553", "references": [{"source": "[email protected]", "url": "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.5"}, {"source": "[email protected]", "url": "https://github.com/PrestaShop/PrestaShop/releases/tag/9.1.0"}, {"source": "[email protected]", "url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-35pf-37c6-jxjv"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0-alpha.1,9.1.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.2.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PrestaShop", "source": "cna", "vendor": "PrestaShop"}, "product": "prestashop", "vendor": "prestashop"}], "analysis": {"en": {"generated_at": "2026-03-26T23:51:47.142563+00:00", "value": {"mitigation_remediation": ["Upgrade PrestaShop to version 8.2.5 or 9.1.0 (or later)", "If an immediate upgrade is not possible, restrict back\u2011office user permissions to prevent database write operations that could inject malicious content", "Disable or limit template editing features until a patch can be applied", "Verify the latest security advisories and monitor logs for unauthorized database changes"], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting in PrestaShop back\u2011office"}, "threat_synthesis": {"affected_systems": "All installations of PrestaShop running a version older than 8.2.5 or 9.1.0 are susceptible. Version 8.2.5 and 9.1.0 include the necessary fix and are not affected.", "description_and_impact": "PrestaShop versions prior to 8.2.5 and 9.1.0 contain multiple stored XSS flaws in back\u2011office templates caused by unprotected template variables. An attacker who can inject data into the database\u2014either through limited back\u2011office access or via a previously existing vulnerability\u2014may embed malicious code that will execute whenever the affected templates are rendered. The vulnerability allows exploitation of the front\u2011end rendering engine from data written in the database, resulting in scripts that run with the privileges of any authenticated administrator who views the page.", "risk_and_exploitability": "The CVSS score of 7.7 indicates high severity, while the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The likely attack vector involves an attacker writing malicious input to the database through the back\u2011office, which is inferred from the description. After injection, the stored script will execute each time the relevant page is rendered for any privileged user."}}}}, "created": "2026-03-27T08:31:39.364819+00:00", "updated": "2026-03-27T09:23:05.553152+00:00", "vendors": ["prestashop", "prestashop$PRODUCT$prestashop"]}