CVE-2023-39676

Deeper analysis

The FieldPopupNewsletter Prestashop Module version 1.0.0 is affected by a reflected cross-site scripting vulnerability (CWE-79) that resides in the callback parameter processed by ajax.php. The issue carries a CVSS 3.1 base score of 6.1 and permits an unauthenticated remote attacker to supply arbitrary JavaScript that is reflected back to a victim’s browser.

An attacker can exploit the flaw by crafting a malicious link containing a script in the callback parameter and persuading a user to click it. Successful exploitation executes the attacker’s code in the context of the Prestashop site, enabling theft of cookies, session tokens, or other client-side actions without requiring authentication.

Public references consist of technical write-ups published on blog.sorcery.ie that describe the discovery; no vendor advisory, patch release, or official mitigation guidance appears among the listed sources. The associated EPSS scores remain low, with a current value of 0.0526 and a peak of 0.0613, indicating limited observed exploitation interest to date.