CVE-2024-21628

CVE-2024-21628 is a stored Cross-Site Scripting (XSS) vulnerability affecting PrestaShop versions prior to 8.1.3. An attacker can inject malicious HTML into the database via a form that does not properly sanitize input. While the backend (BO) is protected by Twig's escaping, the frontend (FO) can render the XSS, impacting only the customer who submitted it or their session. The vulnerability has a CVSS score of 6.1 (MEDIUM), indicating a network-based attack with low complexity, requiring user interaction, and leading to low impact on confidentiality and integrity. Its EPSS score is very low, suggesting a minimal likelihood of exploitation. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, indicating a low current threat level.