CVE-2026-38725: n/a

CVE-2026-38725 describes a stored XSS vulnerability in the xipblog module for PrestaShop versions 2.0.1 and earlier. The vulnerability arises because user input from the name and content parameters in ajax.php is stored without HTML sanitization and rendered in Smarty templates without output escaping. This allows unauthenticated remote attackers to inject JavaScript that executes in the context of an administrator's session when reviewing comments in the back office, enabling potential full compromise of the store.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the administrator's browser context, leading to potential full compromise of the PrestaShop store. This includes theft of admin session tokens, unauthorized actions, and control over the store's backend.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the back office and avoid reviewing untrusted comments. Monitor vendor channels for updates and apply official patches once released.