CVE-2026-33673
Published: 26 March 2026
Summary
CVE-2026-33673 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Prestashop Prestashop. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-33673 is a stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting the back-office (BO) component of PrestaShop, an open-source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable due to unprotected variables in back-office templates that fail to sanitize injected data. The issue carries a CVSS v3.1 base score of 7.6 (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H), indicating high potential impact despite elevated requirements for exploitation.
Exploitation requires an attacker to first inject malicious data into the database, which could occur through limited back-office access or a separate preexisting vulnerability. Once injected, the stored payload executes as XSS when back-office users interact with affected templates, potentially allowing attackers to steal session cookies, impersonate administrators, or perform arbitrary actions in the victim's browser context. The attack is network-accessible but demands high privileges, complexity, and user interaction, with changed scope amplifying confidentiality, integrity, and availability impacts.
PrestaShop advisories recommend upgrading to version 8.2.5 or 9.1.0, where the fix has been implemented, as detailed in the security advisory GHSA-35pf-37c6-jxjv and corresponding release notes. No workarounds are available for affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16441
Vulnerability details
PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-office access or…
more
a previously existing vulnerability, can exploit unprotected variables in back-office templates. Versions 8.2.5 and 9.1.0 contain a fix. No known workarounds are available.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS directly enables exploitation of the web application (T1190); payload execution in admin browser context facilitates session hijacking (T1185), cookie theft (T1539), and impersonation via valid accounts (T1078).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses stored XSS by requiring filtering of information output to back-office templates, preventing execution of injected malicious scripts.
Enforces validation of inputs to the database, blocking injection of malicious payloads that enable the stored XSS vulnerability.
Mandates timely identification, reporting, and remediation of flaws like this unprotected template vulnerability through patching to fixed versions.