CVE-2026-14846

MediumCVSS 4.5/10Last modified Oct 24, 2026

Description

In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the ‘Get my data in CSV’ tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim’s personal data.

Metrics

CVSS 4.0 4.5/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-1236

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-148474.3The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related A CVE-2026-148485.4The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-sub CVE-2026-148493.7The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predict CVE-2026-14852.8A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is sto CVE-2026-148508.8The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An a CVE-2026-148519.2A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally ide CVE-2026-148525.2Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local CVE-2026-148534.3The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check c CVE-2026-148547.5The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of it CVE-2026-148556.4The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and CVE-2026-148566.3A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by in CVE-2026-148574.3The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified