medium6.2
CVE-2025-24027
ps_contactinfo has a potential XSS due to usage of the nofilter tag in template
Impact
### Impact This can not be exploited in a fresh install of PrestaShop, only shops made vulnerable by third party modules are concerned. For example, if your shop has a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored XSS in FO. ### Patches The long term fix is to have all your modules maintained and updated. The fix on ps_contactinfo will keep formatted addresses from displaying an xss stored in the database. ### Workarounds none ### References none
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | prestashop/ps_contactinfo | <= 3.3.2 | 3.3.3 |
Affected products
| Product | Affected versions |
|---|---|
| Versions | through 3.3.2. |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/PrestaShop/ps_contactinfo/commit/d60f9a5634b4fc2d3a8831fb08fe2e1f23cbfa39
- https://github.com/PrestaShop/ps_contactinfo/security/advisories/GHSA-35pq-7pv2-2rfw
- https://github.com/advisories/GHSA-35pq-7pv2-2rfw
- https://nvd.nist.gov/vuln/detail/CVE-2025-24027