CVE-2026-38725: XSS
xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting in Stored Cross-Site Scripting (XSS). When an administrator reviews comments in the back office, the payload executes with admin-level session context, leading to full store compromise.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
PrestaShop stores using xipblog version 2.0.1 or earlier are exposed if the module's ajax.php endpoint is reachable by unauthenticated remote users. An attacker does not need an account to submit the malicious name or content values.
What causes the impact to become a full store compromise?
The injected JavaScript is stored and later rendered without output escaping. It executes when an administrator reviews comments in the PrestaShop back office, allowing the payload to run in that administrator's session context.
How can I tell whether an attempted exploit has occurred?
Review xipblog comment records for suspicious HTML or JavaScript in the name and content fields, especially comments that may have been viewed by back-office administrators. The vulnerable flow stores submitted input in the database without HTML sanitization.