PrestaShop versions older than 8.2.5 and 9.1.0 allow attackers to inject malicious JavaScript into back‑office templates. The injection is stored, meaning the code persists in the database and runs automatically when other back‑office users view the affected pages. This can lead to the hijacking of user sessions, credential theft, or the execution of further attacks from the victim’s browser. The flaw is a classic stored XSS weakness classified as CWE‑79.

The vulnerability is present in all PrestaShop instances less than versions 8.2.5 and 9.1.0. Any deployment using those major releases that has not applied the security update is at risk. The updates that fix the problem are available in release 8.2.5 and 9.1.0.

The CVSS score of 7.7 indicates a high level of risk, but the EPSS score of less than 1% suggests that active exploitation is currently uncommon. The flaw is not listed in CISA’s KEV catalog, meaning no widespread exploitation has been reported. Attackers need the ability to add or modify data in the back‑office database, either by holding limited back‑office access or by exploiting another vulnerability that provides that capability. Once the malicious script is stored, any user who views the affected page will be exposed.