CVE-2026-33673: PrestaShop Multiple Stored XSS Vulnerabilities in Back-Office Templates
Summary
CVE-2026-33673: PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables. Affects prestashop/prestashop across 2 version ranges.
< 8.2.5
>= 9.0.0-alpha.1, < 9.1.0
Fixed in 8.2.5 or 9.1.0, depending on the release line you run. How to fix ↓
Also tracked for
- prestashop · Bitnami
The same CVE-2026-33673 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PrestaShop is a widely-used open-source e-commerce platform that enables users to create and manage online stores. It offers a range of features including product management, payment processing, and customizable templates. However, it is susceptible to security vulnerabilities, particularly in its back-office interface, where unprotected template variables can be exploited.
Vulnerability Detail
This vulnerability involves multiple stored Cross-Site Scripting (XSS) flaws within the back-office (BO) of PrestaShop. An attacker with limited access to the back-office or through a pre-existing vulnerability can inject malicious scripts into the database. These scripts can then be executed when unprotected template variables are rendered, potentially compromising user data and the integrity of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.2.58.2.5composer require prestashop/prestashop:8.2.5 -
>= 9.0.0-alpha.1, < 9.1.09.1.0composer require prestashop/prestashop:9.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no workarounds available for this vulnerability. The best course of action is to update to the patched versions as soon as possible.
Conclusion
The CVE-2026-33673 vulnerability in PrestaShop highlights the importance of securing back-office interfaces against stored XSS attacks. Users are strongly advised to update to the latest patched versions to protect their applications from potential exploitation.
See every vulnerability recorded for prestashop/prestashop →
FAQ
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored in the database and executed when users access the affected pages.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
If exploited, this vulnerability can lead to unauthorized access to sensitive user data, session hijacking, and the potential for further attacks on the application.
Yes, it is crucial to update to the patched versions (8.2.5 or 9.1.0) to mitigate the risk of exploitation.
If you are unable to update, consider reviewing your back-office access controls and monitoring for any suspicious activity, although this is not a substitute for applying the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for prestashop/prestashop.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
