The attacker can supply malicious code through the name and content parameters in the xipblog module’s ajax.php endpoint. The input is written to the database without sanitization and later rendered into Smarty templates without escaping, enabling a stored cross‑site scripting flaw. When an administrator views comments in the back office, the injected script runs in the context of the admin session, giving the attacker full control over the store.

PrestaShop installations that use the xipblog module version 2.0.1 or older are affected. No other vendors or products are listed.

The vulnerability is exploitable by any remote actor without authentication. The description indicates that the script executes with administrative privileges once an admin browses comments, so the impact is high. The CVSS score is 5.4, and the EPSS score is not available. The vulnerability is not listed as a known exploited vulnerability by CISA, but the potential for full compromise makes it a serious risk.