PrestaShop versions prior to 8.2.5 and 9.1.0 are susceptible to stored Cross-Site Scripting vulnerabilities, which could allow an attacker with back-office access to compromise administrative sessions.

The application is vulnerable to stored Cross-Site Scripting (CWE-79) within the back-office interface. An attacker must possess limited back-office privileges or leverage a secondary vulnerability to inject malicious payloads into the database, which then execute when administrative templates are rendered.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of an administrator session. This can lead to full account takeover, unauthorized modification of site content, or the exfiltration of sensitive administrative data. With a CVSS score of 7.6, this vulnerability represents a significant risk to the integrity and confidentiality of the e-commerce platform.

Immediate Action: Update PrestaShop to version 8.2.5 or 9.1.0 immediately to apply the vendor-provided security patches.

Proactive Monitoring: Review back-office access logs for unusual administrative activity or unauthorized modifications to system configurations and template files.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block malicious injection attempts targeting back-office endpoints.

Public Exploit Available: Unknown

Given the potential for administrative account compromise, administrators should prioritize updating their PrestaShop installations to the patched versions. Because this flaw involves stored XSS within the back-office, ensure that all administrative accounts are secured with strong credentials and multi-factor authentication to limit the impact of any potential session hijacking attempts.