CVE-2024-21627
Some attribute not escaped in Validate::isCleanHTML method
PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the isCleanHTML method. Some modules using the isCleanHTML method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Some attribute not escaped in Validate::isCleanHTML method
PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the isCleanHTML method. Some modules using the isCleanHTML method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
- Record
CVE-2024-21627- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79, CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2024-0457
PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the isCleanHTML method. Some modules using the isCleanHTML method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
- Record
EUVD-2024-0457- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xgpm-q3mq-46rq
PrestaShop some attribute not escaped in Validate::isCleanHTML method
Description
Some event attributes are not detected by the isCleanHTML method
Impact
Some modules using the isCleanHTML method could be vulnerable to xss
Patches
8.1.3, 1.7.8.11
Workarounds
The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
Reporters
Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).
- Record
GHSA-xgpm-q3mq-46rq- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
NVD
PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the isCleanHTML method. Some modules using the isCleanHTML method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
- Record
CVE-2024-21627- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
OSV
Some attribute not escaped in Validate::isCleanHTML method
PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the isCleanHTML method. Some modules using the isCleanHTML method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
- Record
CVE-2024-21627- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
OSVGHSA-xgpm-q3mq-46rq
PrestaShop some attribute not escaped in Validate::isCleanHTML method
Description
Some event attributes are not detected by the isCleanHTML method
Impact
Some modules using the isCleanHTML method could be vulnerable to xss
Patches
8.1.3, 1.7.8.11
Workarounds
The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
Reporters
Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).
- Record
GHSA-xgpm-q3mq-46rq- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prestashop/prestashopPackagist |
8.0.0-beta.1 up to 8.1.3 | 8.1.3 |
prestashop/prestashopPackagist |
before 1.7.8.11 | 1.7.8.11 |
prestashop/prestashopPackagist |
8.0.0-beta.1 up to 8.1.3, plus listed versions 8.0.08.0.0-rc.18.0.18.0.28.0.3 Show 7 moreShow less8.0.48.0.58.1.08.1.0-beta.18.1.0-rc.18.1.18.1.2 |
8.1.3 |
prestashop/prestashopPackagist |
before 1.7.8.11, plus listed versions 1.7.0.01.7.0.0-beta.1.01.7.0.0-beta.2.01.7.0.0-beta.3.01.7.0.0-beta.4.0 Show 45 moreShow less1.7.0.0-rc.0.01.7.0.0-rc.1.01.7.0.0-rc.2.01.7.0.11.7.0.21.7.0.31.7.0.41.7.0.51.7.0.61.7.1.01.7.1.11.7.1.21.7.2.01.7.2.0-rc.1.01.7.2.11.7.2.21.7.2.31.7.2.41.7.2.51.7.3.01.7.3.11.7.3.21.7.3.31.7.3.41.7.4.01.7.4.0-beta.11.7.4.11.7.4.21.7.4.31.7.4.41.7.5.01.7.5.0-beta.11.7.5.0-rc.11.7.5.11.7.5.21.7.6.01.7.6.0-beta.11.7.6.0-rc.11.7.6.0-rc.21.7.6.11.7.6.21.7.6.31.7.6.41.7.6.51.7.6.6 |
1.7.8.11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21627 is a high vulnerability (CVSS 8.1) in Prestashop, published January 2, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in prestashop/prestashop 8.1.3.
References
github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xgpm-q3mq-46rq
nvd.nist.gov/vuln/detail/CVE-2024-21627
Left out here: 28 versions. The JSON record has them.