CVE-2023-30838

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) injection, allowed by the presence of pre-setup `@keyframes` methods. This XSS, which hijacks HTML attributes, can be triggered without any interaction by the visitor/administrator, which makes it as dangerous as a trivial XSS attack. Contrary to other attacks which target HTML attributes and are triggered without user interaction (such as onload / onerror which suffer from a very limited scope), this one can hijack every HTML element, which increases the danger due to a complete HTML elements scope. Versions 8.0.4 and 1.7.8.9 contain a fix for this issue.

• CWE-79

• https://github.com/PrestaShop/PrestaShop/commit/46408ae4b02f3b8b1bb6e9dc63af5bcd858abd9cPatch
• https://github.com/PrestaShop/PrestaShop/commit/dc682192df0e4b0d656a8e645b29ca1b9dbe3693Patch
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fh7r-996q-gvcpVendor Advisory
• https://github.com/PrestaShop/PrestaShop/commit/46408ae4b02f3b8b1bb6e9dc63af5bcd858abd9cPatch
• https://github.com/PrestaShop/PrestaShop/commit/dc682192df0e4b0d656a8e645b29ca1b9dbe3693Patch
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fh7r-996q-gvcpVendor Advisory

Published

Apr 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30805The Sangfor Next-Gen Application Firewall version NGAF8.0.17…9.8
• CVE-2023-30806The Sangfor Next-Gen Application Firewall version NGAF8.0.17…9.8
• CVE-2023-3081The WP Mail Logging plugin for WordPress is vulnerable to St…6.1
• CVE-2023-3082The Post SMTP plugin for WordPress is vulnerable to Stored C…6.1
• CVE-2023-3083Cross-site Scripting (XSS) - Stored in GitHub repository nil…8.7
• CVE-2023-30837Vyper is a pythonic smart contract language for the EVM. The…7.5
• CVE-2023-30839PrestaShop is an Open Source e-commerce web application. Ver…8.8
• CVE-2023-3084Cross-site Scripting (XSS) - Stored in GitHub repository nil…8.1
• CVE-2023-30840Fluid is an open source Kubernetes-native distributed datase…7.8
• CVE-2023-30841Baremetal Operator (BMO) is a bare metal host provisioning i…5.5
• CVE-2023-30842Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-30843Payload is a free and open source headless content managemen…6.5