CVE-2023-39527

    Dashboard / Vulnerabilities / CVE-2023-39527

    CVE-2023-39527

    Published: 7 Aug 2023Last Modified: 12 Aug 2026

    Summary: PrestaShop XSS vulnerability through Validate::isCleanHTML method

    Details: PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCleanHTML` method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39527.json, https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xw2r-f8xv-c8xp, https://nvd.nist.gov/vuln/detail/CVE-2023-39527, https://github.com/PrestaShop/PrestaShop/commit/afc14f8eaa058b3e6a20ac43e033ee2656fb88b4

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1951311beb2497bb97659aded1b643905403becc

    Affected versions

    8.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39527 | CVE-DB