CVE-2023-30838: 
PHP vulnerability analysis and mitigation

PrestaShop, an Open Source e-commerce web application, disclosed a cross-site scripting (XSS) vulnerability tracked as CVE-2023-30838. The vulnerability was discovered in the ValidateCore::isCleanHTML() method and affects versions prior to 8.0.4 and 1.7.8.9. The issue was publicly disclosed on April 25, 2023 (PrestaShop Advisory).

The vulnerability stems from the ValidateCore::isCleanHTML() method missing hijackable events that can lead to XSS injection through pre-setup @keyframes methods. The severity of this vulnerability is rated as HIGH with a CVSS v3.1 base score of 8.5 according to GitHub's assessment, while the NVD rates it as CRITICAL with a score of 9.9 (NVD).

This XSS vulnerability is particularly dangerous as it can be triggered without any user interaction from visitors or administrators. Unlike typical XSS attacks that target specific HTML attributes with limited scope (such as onload/onerror), this vulnerability can hijack any HTML element, significantly increasing its potential impact (PrestaShop Advisory).

The vulnerability has been patched in PrestaShop versions 8.0.4 and 1.7.8.9. No workarounds are available, making it crucial for users to upgrade to the patched versions (PrestaShop Advisory).