Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup:…

published 2023-04-12 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-30821

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.0%; EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known, plus a Nuclei check

Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups().

Patch / fix

fixed in 1 links 1

idnovate popup_module_(on_entering,_exit_popup,_add_product)_and_newsletter 1.1.25

friends-of-presta.github.io/security-advisories/modules/2023/04/11/advancedpopupcreato… advisory

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 20 mo ago (2025-02-10)

Exploit prediction

3.02% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Nuclei template PrestaShop AdvancedPopupCreator - SQL Injection nuclei detection template

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

friends-of-presta.github.io /security-advisories/modules/2023/04/11/advancedpopupcreator.html
patch, third-party-advisory
addons.prestashop.com /en/pop-up/23773-popup-on-entry-exit-popup-add-product-and-newsletter.html
product

Sources

CVE List CVE-2023-27032
NVD CVE-2023-27032

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary