Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2020-26225: PrestaShop Product Comments: Malicious Links Can Inject Code
CVE-2020-26225 · published 5 years ago
Summary
An attacker can inject malicious code into your customers' browsers if they click a specially crafted link in PrestaShop Product Comments. This can happen if you're using a version of PrestaShop older than 4.2.0. Update to version 4.2.0 or later to fix this issue.
What to do
- Update prestashop productcomments to version 4.2.0.
- Update prestashop product_comments to version 4.2.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | prestashop | productcomments |
>= 4.0.0, < 4.2.0 Fix: upgrade to 4.2.0
|
| – | prestashop | product_comments |
>= 4.0.0, < 4.2.0 cpe:2.3:a:prestashop:product_comments:*:*:*:*:*:*:*:* |
Original advisory text
In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0...
In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2.0
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
6.1
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published16 Nov 2020
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta