CVE-2025-24027 ps_contactinfo has potential XSS due to usage of the nofilter tag in template
Stored XSS in PrestaShop contact info module allows attackers to execute scripts if data is compromised by other vulnerable modules.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-24027?
CVE-2025-24027 is a medium-severity cross-site scripting vulnerability in PrestaShop ps_contactinfo, published on 22 Jan 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting (XSS) vulnerability in versions up to and including 3.3.2. This can not be exploited in a fresh install of PrestaShop, only shops made vulnerable by third party modules are concerned. For example, if the shop has a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored cross-site scripting in formatting objects. Commit d60f9a5634b4fc2d3a8831fb08fe2e1f23cbfa39 keeps formatted addresses from displaying a XSS stored in the database, and the fix is expected to be available in version 3.3.3. No workarounds are available aside from applying the fix and keeping all modules maintained and update.
Weakness: CWE-79
Which versions are affected by CVE-2025-24027?
2 open source packages ship an affected version, including prestashop/ps_contactinfo.
| Package | Affected | Fixed in |
|---|---|---|
prestashop/ps_contactinfo Packagist | All versions | 3.3.3 |
prestashop/ps_contactinfo Packagist | All versions | 3.3.3 |
How do I fix CVE-2025-24027?
Upgrade prestashop/ps_contactinfo to 3.3.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-24027 being exploited?
There is no known exploitation of CVE-2025-24027 in the wild and no public exploit code.
Sources
Also known as GHSA-35pq-7pv2-2rfw.