CVE-2019-11876

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-05-24 · updated 2026-06-17
Weakness: CWE-79

Description

In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing the malicious link.

Affected products

Drupal: 8.7.0
PrestaShop: 1.7.5.2

References

https://www.logicallysecure.com/blog/xss-presta-xss-drupal/
https://www.prestashop.com/forums/forum/2-prestashop-news-and-releases/
https://www.logicallysecure.com/blog/xss-presta-xss-drupal/
https://www.prestashop.com/forums/forum/2-prestashop-news-and-releases/

Get alerted when CVE-2019-11876 or the next vulnerability affects your stack