I can see that browsing url like this
shows alert into browser window.
Is their any way to prevent it ? its XSS.
Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It only takes a minute to sign up.Sign up to join this community
As mentioned in the comments
I can confirm that by default this doesn't happen. I can conclude that this has something to do with tour custom code. I assume that p parameter is paging for something and I assume it should be an integer. Change your code that reads this parameter and convert it to int. Or better yet, if you are printing it somewhere make sure you escape the values (stip_tags for example if you don't want tags in there)
If the script tag is not printed anywhere, this means that it is escaped somehow and you are safe from XSS