CVE-2026-44212

PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover. This vulnerability is fixed in 8.2.6 and 9.1.1.

• CWE-79

• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-w9f3-qc75-qgx9

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44206Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-44207Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-44208Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-44209Banks generates meaningful LLM prompts using a template lang…7.5
• CVE-2026-44210Kata Containers is an open source project focusing on a stan…9.9
• CVE-2026-44211Cline is an autonomous coding agent as an SDK, IDE extension…9.6
• CVE-2026-44213The OpenTelemetry.Exporter.Instana exports telemetry to Inst…6.5
• CVE-2026-44214eventsource-encoder encodes events as well-formed EventSourc…5.3
• CVE-2026-44215NanaZip is an open source file archive. From 5.0.1252.0 to b…7.1
• CVE-2026-44216Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8…7.5
• CVE-2026-44217sse-channel is an SSE-implementation which can be used to an…6.6
• CVE-2026-44218ciguard is a static security auditor for CI/CD pipelines. Fr…3