CVE-2026-33673

HIGH7.6EPSS 0.02%

PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables

Published: 3/25/2026Modified: 3/30/2026

Also known as:GHSA-35pf-37c6-jxjvBIT-prestashop-2026-33673

Description

### Impact Multiple stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO: an attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates. ### Patches Patched on 8.2.5 and 9.1.0 ### Workarounds None ### References None

Affected packages (2)

Bitnami/prestashopfrom 0, < 8.2.5, >= 9.0.0, < 9.1.0
Packagist/prestashop/prestashop>= 9.0.0-alpha.1, < 9.1.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-33673
PATCHhttps://github.com/PrestaShop/PrestaShop
WEBhttps://github.com/PrestaShop/PrestaShop/releases/tag/8.2.5
WEBhttps://github.com/PrestaShop/PrestaShop/releases/tag/9.1.0
WEBhttps://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-35pf-37c6-jxjv