What’s Vulnerable › Vulnerabilities

CVE-2020-15162: Stored XSS in PrestaShop

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-09-24 · updated 2026-06-17
• Weakness: CWE-79

Description

In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.

Affected products

• PrestaShop: from 1.5.0.0 before 1.7.6.8 — fixed in 1.7.6.8

How to fix

Upgrade to a fixed version: PrestaShop 1.7.6.8. Check the vendor advisory for mitigations.

References

• https://github.com/PrestaShop/PrestaShop/commit/2cfcd33c75974a49f17665f294f228454e14d9cf
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-rc8c-v7rq-q392
• https://github.com/PrestaShop/PrestaShop/commit/2cfcd33c75974a49f17665f294f228454e14d9cf
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-rc8c-v7rq-q392

Get alerted when CVE-2020-15162 or the next vulnerability affects your stack