Prestashop · Prestashop · CVE-2019-11876
**Name of the Vulnerable Software and Affected Versions**
PrestaShop version 1.7.5.2
**Description**
The issue concerns a Reflected XSS affecting the `shop country` parameter in the `install/index.php` installation script/component. Exploitation requires a user to follow the initial setup stages, including accepting terms and conditions, before executing a malicious link.
**Recommendations**
For PrestaShop version 1.7.5.2, as a temporary workaround, consider restricting access to the `install/index.php` script until a patch is available. Avoid using the `shop country` parameter in the installation process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.