Stored Cross-Site Scripting Vulnerability in PrestaShop by XIPBlog Module

CVE-2026-38725

What is CVE-2026-38725?

A vulnerability in the XIPBlog module for PrestaShop allows unauthorized users to inject malicious JavaScript through the name and content parameters in ajax.php. This unsanitized input is stored in the database and subsequently rendered in Smarty templates without proper output escaping. As a result, when an administrator views comments within the back office, the injected payload executes in the context of the administrator’s session, potentially compromising the entire store. This highlights the critical need for proper input validation and output sanitization to prevent such exploits.

References