Skip to content
Prestashop vulnerabilities
Newest
-
prestashop blockwishlist
PrestaShop blockwishlist through 3.0.2 Information Disclosure
CVE-2026-92810
5.3 Medium
-
prestashop psgdpr
PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
CVE-2026-92809
5.3 Medium
-
prestashop
Incorrect access control in PrestaShop
CVE-2026-84186
6.9 Medium
-
prestashop the firmware
Incorrect neutralisation in the PrestaShop firmware
CVE-2026-14846
4.5 Medium
-
prestashop ps facetedsearch
ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
CVE-2026-54159
Fix available
10.0 Critical
-
prestashop
PrestaShop: Stored XSS executable in customer service view
CVE-2026-44212
Fix available
9.3 Critical
-
prestashop
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
CVE-2026-33673
Fix available
7.7 High
-
prestashop
PrestaShop: Improper Use of Validation Framework
CVE-2026-33674
Fix available
2.0 Low
-
prestashop
PrestaShop has a time based enumeration in FO login form
CVE-2026-25597
Fix available
5.3 Medium
-
prestashop checkout, prestashopcorp ps checkout +1 more
PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
CVE-2025-61924
Fix available
3.8 Low
-
prestashop checkout, prestashopcorp ps checkout +1 more
PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure
CVE-2025-61923
Fix available
4.1 Medium
-
prestashop checkout, prestashopcorp ps checkout +1 more
PrestaShop Checkout allows customer account takeover via email
CVE-2025-61922
Public exploitFix available
9.1 Critical
-
prestashop
Presta Shop vulnerable to email enumeration
CVE-2025-51586
Public exploitFix available
3.7 Low
-
prestashop
A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows...
CVE-2025-25692
6.5 Medium
-
prestashop
A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows...
CVE-2025-25691
6.5 Medium
-
prestashop
Cross-Site Scripting (XSS) vulnerability in Prestashop
CVE-2025-1230
4.8 Medium
-
prestashop ps contactinfo
ps_contactinfo has potential XSS due to usage of the nofilter tag in template
CVE-2025-24027
Fix available
6.2 Medium
-
prestashop
In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within...
CVE-2024-36626
5.3 Medium
-
prestashop
An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via...
CVE-2024-41651
Public exploitDisputed
8.1 High
-
prestashop helpdesk
SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" ...
CVE-2024-34992
8.8 High
-
prestashop quadra informatique
In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can...
CVE-2024-34991
7.5 High
-
prestashop ask for a quote
SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro"...
CVE-2024-34988
9.8 Critical
-
prestashop m4 pdf
PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from...
CVE-2023-50029
Public exploit
10.0 Critical
-
prestashop
In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a...
CVE-2024-34989
9.8 Critical
-
prestashop pk customlinks
In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can...
CVE-2024-36684
9.8 Critical
-
prestashop livechatpro
In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can...
CVE-2024-36679
10.0 Critical
-
prestashop loginascustomerpro
In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a...
CVE-2024-36677
7.5 High
-
prestashop channable
In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest...
CVE-2024-34994
9.8 Critical
-
prestashop helpdesk
In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0...
CVE-2024-34990
10.0 Critical
-
prestashop
Anonymous PrestaShop customer can download other customers' invoices
CVE-2024-34717
Fix available
5.3 Medium
-
prestashop
PrestaShop vulnerable to XSS via customer contact form in FO, through file upload
CVE-2024-34716
Public exploitFix available
EPSS 56.4%
9.7 Critical
-
prestashop fme
Directory Traversal vulnerability in FME Modules customfields v.2.2.7 and before allows a remote...
CVE-2024-33274
7.5 High
-
prestashop
An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote...
CVE-2024-33270
7.5 High
-
prestashop
SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a...
CVE-2024-33276
9.8 Critical
-
prestashop
SQL injection vulnerability in KnowBand for PrestaShop autosuggest before 2.0.0 allows an...
CVE-2024-33272
6.8 Medium
-
prestashop fme
An issue in FME Modules eventsmanager before 4.4.0 allows an attacker to obtain sensitive...
CVE-2024-33271
7.5 High
-
prestashop scalapay
SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate...
CVE-2024-28393
9.8 Critical
-
prestashop abandoned cart reminder pro
SQL injection vulnerability in pscartabandonmentpro v.2.0.11 and before allows a remote attacker...
CVE-2024-28392
9.8 Critical
-
cleanpresta cd custom fields 4 orders, prestashop +1 more
In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com...
CVE-2024-25845
9.8 Critical
-
communitydeveloper import\/update bulk product from any csv\/excel file pro, prestashop import\/update bulk product +1 more
In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to...
CVE-2024-25843
9.8 Critical
-
prestashop
Prestashop vulnerable to path disclosure in JavaScript variable
CVE-2024-26129
Fix available
5.8 Medium
-
prestashop advanced loyalty program
An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status.
CVE-2023-48926
5.3 Medium
-
prestashop
XSS can be stored in DB from "add a message form" in order detail page (FO)
CVE-2024-21628
Fix available
5.4 Medium
-
prestashop
Some attribute not escaped in Validate::isCleanHTML method
CVE-2024-21627
Fix available
8.1 High
-
activedesign newsletterpop, prestashop newsletter popup pro +1 more
In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6...
CVE-2023-47308
9.8 Critical
-
prestashop blockreassurance, customer reassurance block +1 more
Any value can be changed in the configuration table by an employee having access to block reassurance module
CVE-2023-47110
Fix available
9.1 Critical
-
prestashop blockreassurance, customer reassurance block +1 more
PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block
CVE-2023-47109
Fix available
5.5 Medium
-
prestashop
Improper Privilege Management in Prestashop
CVE-2023-43663
Fix available
6.3 Medium
-
prestashop
Employee without any access rights can list all installed modules in Prestashop
CVE-2023-43664
Fix available
4.3 Medium
-
prestashop m4 pdf plugin, m4 pdf +1 more
Cross-site Scripting in M4 PDF plugin for Prestashop sites
CVE-2022-45448
3.5 Low
- Show olderLoading…