PrestaShop versions prior to 8.2.5 and 9.1.0 contain multiple stored XSS flaws in back‑office templates caused by unprotected template variables. An attacker who can inject data into the database—either through limited back‑office access or via a previously existing vulnerability—may embed malicious code that will execute whenever the affected templates are rendered. The vulnerability allows exploitation of the front‑end rendering engine from data written in the database, resulting in scripts that run with the privileges of any authenticated administrator who views the page.

All installations of PrestaShop running a version older than 8.2.5 or 9.1.0 are susceptible. Version 8.2.5 and 9.1.0 include the necessary fix and are not affected.

The CVSS score of 7.7 indicates high severity, while the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The likely attack vector involves an attacker writing malicious input to the database through the back‑office, which is inferred from the description. After injection, the stored script will execute each time the relevant page is rendered for any privileged user.