CVE-2026-44212: PrestaShop: Stored XSS in Customer Service back-office view
CVE-2026-44212 is a stored cross-site scripting flaw in the PrestaShop back-office Customer Service view, affecting versions before 8.2.6 and from 9.0.0-alpha.1 before 9.1.1. According to the record, an unauthenticated attacker can submit a payload through the public Contact Us form, which runs when a back-office employee opens the affected thread. The CNA rates it critical with a CVSS v3.1 score of 9.3, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-44212 is a stored cross-site scripting (XSS) weakness classified as CWE-79 in the Customer Service view of the PrestaShop back-office. According to the record, the malicious input enters through the public Contact Us form and is rendered later for a back-office employee. The issue is documented in GitHub Security Advisory GHSA-w9f3-qc75-qgx9.
Impact
- The record describes session hijacking and full back-office takeover as possible outcomes.
- The CVSS v3.1 vector indicates a network attack, no privileges required, user interaction required, a changed scope, and high confidentiality and integrity impact.
- The SSVC technical impact is recorded as total.
Affected products and versions
- PrestaShop before 8.2.6.
- PrestaShop from 9.0.0-alpha.1 up to, but not including, 9.1.1.
The structured fix list in the record is empty, but the description states that the issue is fixed in 8.2.6 and 9.1.1.
Exploitation status
- The CISA KEV catalog does not list this CVE according to the record.
- The SSVC exploitation field is recorded as none and the automatable field as no.
- No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Upgrade installations on the affected branches to 8.2.6 or later, or to 9.1.1 or later for the 9 branch.
- Until the upgrade is applied, restrict back-office access to trusted networks and staff.
- Reduce exposure by limiting how often employees open customer threads that originate from the public contact form until patching is complete.
- Consult the GitHub Security Advisory for vendor guidance.
Detection guidance
- Review stored Customer Service messages and contact form records for unexpected markup or script-like content in email fields.
- Monitor back-office sessions for unusual activity, such as logins from unfamiliar locations or unexpected administrative changes.
- Keep audit logs of back-office access so suspicious activity can be reviewed.
Limitations of the available information
- The record does not include commit references, patch diffs or a detailed technical write-up beyond the advisory link.
- The structured fixes field is empty, so the fixed versions are taken from the description text.
- Whether web application firewalls or input filters would block the stored content is unknown from the record.
Frequently asked questions
Which PrestaShop versions are affected by CVE-2026-44212?
The record lists versions before 8.2.6 and versions from 9.0.0-alpha.1 up to, but not including, 9.1.1 as affected.
How can an attacker trigger this stored XSS?
According to the record, the payload is submitted through the public Contact Us form with a malicious email address and executes when a back-office employee opens the affected customer thread.
Is this CVE known to be exploited in the wild?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.