Sign in
Deutsch English Español Polski
High

PrestaShop some attribute not escaped in Validate::isCleanHTML method

  • Disclosed: 03.01.2024
  • Updated: 11.10.2026 10:22

Description

Some event attributes are not detected by the isCleanHTML method

Impact

Some modules using the isCleanHTML method could be vulnerable to xss

Patches

8.1.3, 1.7.8.11

Workarounds

The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.

Reporters

Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package prestashop/prestashop >= 8.0.0-beta.1, < 8.1.3, < 1.7.8.11 8.1.3, 1.7.8.11
PrestaShop (core) prestashop/prestashop >= 8.0.0-beta.1, < 8.1.3, < 1.7.8.11 8.1.3, 1.7.8.11

References

CVSS score 8.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Weakness (CWE)
CWE-20, CWE-79
Platform
Composer, PrestaShop
Package
prestashop/prestashop
Disclosed
03.01.2024
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-xgpm-q3mq-46rq - CC BY 4.0

Vulnerability history: prestashop/prestashop

All published vulnerabilities of this package (PrestaShop (core)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (32) in the archive
Total entries
32
First → latest
01.2020 05.2026
Without a fix
9
Exploited in attacks
1

Severity breakdown

  • Critical 6
  • High 8
  • Medium 17
  • Low 1

Disclosures per year

Severity:
  1. PrestaShop has a stored XSS executable in customer service view
    Critical · 9.3 CVE-2026-44212 < 8.2.6, >= 9.0.0, < 9.1.1 8.2.6, 9.1.1
  2. PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
    High · 7.6 CVE-2026-33673 >= 9.0.0-alpha.1, < 9.1.0, < 8.2.5 9.1.0, 8.2.5
  3. PrestaShop cross-site scripting via customer contact form in FO, through file upload
    Critical · 9.6 CVE-2024-34716 >= 8.1.0, < 8.1.6 8.1.6
  4. PrestaShop some attribute not escaped in Validate::isCleanHTML method this entry
    High · 8.1 CVE-2024-21627 >= 8.0.0-beta.1, < 8.1.3, < 1.7.8.11 8.1.3, 1.7.8.11
  5. Possible XSS injection through Validate::isCleanHTML method
    High · 8.3 CVE-2023-39527 >= 8.0.0, < 8.0.5, < 1.7.8.10 no fix
  6. [CVE-2023-39529][CVE-2023-39530] path traversal: file deletion in the backoffice
    High · 6.7 CVE-2023-39525 <= 8.1.0 no fix
  7. Reading a file through path traversal & Remote Code Execution via unsafe deserialization
    Critical · 9.1 CVE-2023-39528 <= 8.1.0 no fix
  8. Chain: SQL Injection (CWE-89) and Eval Injection (CWE-95)
    Critical · 9.8 CVE-2022-31181 >= 1.6.0.10, < 1.7.8.7 1.7.8.7
  9. PrestaShop PHP Object Injection
    High · 8.8 CVE-2018-20717 < 1.7.2.5 1.7.2.5
  10. SQL filter bypass leading to arbitrary write requests using SQL Manager [DEBATE RUNNING ABOUT SCORING FROM PS CORE]
    High · 8.8 CVE-2023-30839 >= 8.0.0, < 8.0.3, < 1.7.8.8 no fix
  11. Possible XSS injection through Validate::isCleanHTML method
    High · 8.0 CVE-2023-30838 >= 8.0.0, < 8.0.3, < 1.7.8.8 no fix
  12. Server Side Twig Template Injection
    Critical · 9.0 CVE-2022-21686 >= 1.7.0.0, < 1.7.8.3 1.7.8.3
  13. SQL injection in prestashop/prestashop
    High · 7.5 CVE-2021-43789 >= 1.7.5.0, < 1.7.8.2 1.7.8.2
  14. PHUnit dependancy in PrestaShop and modules allow remote arbitrary PHP code execution
    Critical · 9.8 Exploited in attacks CVE-2017-9841 < 1.7.6.0 no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.