CVE-2025-24027: ps_contactinfo XSS Vulnerability in PrestaShop
Summary
CVE-2025-24027: ps_contactinfo has a potential XSS due to usage of the nofilter tag in template. Affects prestashop/ps_contactinfo versions < 3.3.3. Fixed in 3.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ps_contactinfo package is a component of PrestaShop, an open-source e-commerce platform that enables users to create and manage online stores. This package is responsible for handling contact information on the storefront. It is essential for customer interactions and maintaining communication. However, due to its reliance on third-party modules, it can be susceptible to security vulnerabilities, particularly when those modules are not properly maintained or updated.
Vulnerability Detail
The ps_contactinfo package has a potential Cross-Site Scripting (XSS) vulnerability due to the use of the nofilter tag in its template. This vulnerability can only be exploited in instances where the PrestaShop installation has been compromised by third-party modules that may introduce SQL injection vulnerabilities. If an attacker successfully executes a stored XSS attack, they could manipulate the frontend of the store, potentially leading to data theft or unauthorized actions on behalf of users.
How To Fix
Minimum fixed version
3.3.3
This is the first release that contains the fix.
composer require prestashop/ps_contactinfo:3.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds available for this vulnerability. The best course of action is to update the package to the fixed version.
Conclusion
The ps_contactinfo package in PrestaShop is vulnerable to a potential XSS attack due to improper handling of user input in its templates. It is essential for users to update to the latest version to mitigate this risk and ensure the security of their online stores.
See every vulnerability recorded for prestashop/ps_contactinfo →
FAQ
The vulnerability is a potential XSS due to the usage of the nofilter tag in the ps_contactinfo template.
No, this vulnerability can only be exploited in installations that have been compromised by third-party modules.
If exploited, this vulnerability could allow attackers to execute scripts in the context of the user's session, leading to data theft or unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 6.2, indicating a moderate severity level.
