Prestashop
89 CVEs across 38 Prestashop products. Browse Prestashop vulnerabilities, severities, and proof-of-concept exploits.
Prestashop products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54159 | Critical | 10.0 | 2026-07-17 | PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filt… |
CVE-2026-14846 | | 2026-07-13 | In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ par… | |
CVE-2026-44212 | Critical | 9.3 | 2026-05-14 | PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop… |
CVE-2026-33674 | Low | 2.0 | 2026-03-26 | PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 improperly use the validation framework. Versions 8.2.5 and 9.1.0 co… |
CVE-2026-33673 | High | 7.6 | 2026-03-26 | PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabi… |
CVE-2026-25597 | Medium | 5.3 | 2026-02-06 | PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in the user authenticat… |
CVE-2025-61924 | Low | 3.8 | 2025-10-16 | PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant acco… |
CVE-2025-61923 | Medium | 4.1 | 2025-10-16 | PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing valid… |
CVE-2025-61922 | Critical | 9.1 | 2025-10-16 | PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, miss… |
CVE-2025-51586 | Low | 3.7 | 2025-09-08 | An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the r… |
CVE-2025-25692 | Medium | 6.5 | 2025-07-30 | A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2025-25691 | Medium | 6.5 | 2025-07-30 | A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2025-1230 | Medium | 4.8 | 2025-02-12 | Stored Cross-Site Scripting (XSS) vulnerability in Prestashop 8.1.7, due to the lack of proper validation of user input through ‘/<admin_directory>/index.php’… |
CVE-2025-24027 | Medium | 6.2 | 2025-01-22 | ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting (XSS) vulnerability in versions up to and including 3… |
CVE-2024-36626 | Medium | 5.3 | 2024-11-29 | In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php. |
CVE-2024-41651 | High | 8.1 | 2024-08-12 | An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality. NOTE: this is disputed by mu… |
CVE-2024-36684 | Critical | 9.8 | 2024-06-19 | In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive S… |
CVE-2024-34717 | Medium | 5.3 | 2024-05-14 | PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a… |
CVE-2024-34716 | Critical | 9.6 | 2024-05-14 | PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature… |
CVE-2024-28392 | Critical | 9.8 | 2024-03-20 | SQL injection vulnerability in pscartabandonmentpro v.2.0.11 and before allows a remote attacker to escalate privileges via the pscartabandonmentproFrontCAPUns… |
CVE-2024-25843 | Critical | 9.8 | 2024-02-27 | In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform S… |
CVE-2024-26129 | Medium | 5.8 | 2024-02-19 | PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaSc… |
CVE-2023-48926 | Medium | 5.3 | 2024-01-16 | An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order… |
CVE-2024-21628 | Medium | 5.4 | 2024-01-02 | PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to stor… |
CVE-2024-21627 | High | 8.1 | 2024-01-02 | PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Som… |
CVE-2023-47110 | Critical | 9.1 | 2023-11-09 | blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in mod… |
CVE-2023-47109 | Medium | 5.5 | 2023-11-08 | PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a… |
CVE-2023-43664 | Medium | 4.3 | 2023-09-28 | PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: m… |
CVE-2023-43663 | Medium | 6.3 | 2023-09-28 | PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user ri… |
CVE-2022-45448 | Low | 3.5 | 2023-09-20 | M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pd… |
CVE-2022-45447 | Medium | 6.5 | 2023-09-20 | M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly ch… |
CVE-2023-39530 | Medium | 6.5 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Ve… |
CVE-2023-39529 | Medium | 6.7 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments contr… |
CVE-2023-39528 | Medium | 6.8 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server… |
CVE-2023-39527 | High | 8.3 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCle… |
CVE-2023-39526 | Critical | 9.1 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injec… |
CVE-2023-39525 | Medium | 6.5 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying… |
CVE-2023-39524 | Medium | 6.7 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Vers… |
CVE-2023-33777 | Medium | 5.3 | 2023-07-25 | An issue in /functions/fbaorder.php of Prestashop amazon before v5.2.24 allows attackers to execute a directory traversal attack. |
CVE-2023-30153 | Critical | 9.8 | 2023-07-18 | An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers… |
CVE-2023-30149 | Critical | 9.8 | 2023-06-02 | SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1… |
CVE-2023-30192 | Critical | 9.8 | 2023-05-12 | Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find(). |
CVE-2023-30194 | Critical | 9.8 | 2023-05-10 | Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook(). |
CVE-2023-30282 | High | 7.5 | 2023-05-04 | PrestaShop scexportcustomers <= 3.6.1 is vulnerable to Incorrect Access Control. Due to a lack of permissions' control, a guest can access exports from the mod… |
CVE-2023-30839 | Critical | 9.9 | 2023-04-25 | PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update… |
CVE-2023-30838 | High | 8.5 | 2023-04-25 | PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hij… |
CVE-2023-30545 | High | 7.7 | 2023-04-25 | PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advance… |
CVE-2023-27570 | Critical | 9.8 | 2023-03-21 | The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie. |
CVE-2023-27569 | Critical | 9.8 | 2023-03-21 | The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header. |
CVE-2023-25206 | High | 8.8 | 2023-03-14 | PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection. |
CVE-2023-25207 | Critical | 9.8 | 2023-03-13 | PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php. |
CVE-2023-25170 | Medium | 5.0 | 2023-03-13 | PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating u… |
CVE-2023-24763 | High | 8.8 | 2023-03-06 | In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0. |
CVE-2022-46158 | Medium | 5.3 | 2022-12-08 | PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been abl… |
CVE-2022-35933 | Medium | 6.1 | 2022-09-02 | This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrat… |
CVE-2022-31181 | Critical | 9.8 | 2022-08-01 | PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which ca… |
CVE-2020-21967 | Medium | 4.8 | 2022-07-13 | File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page. |
CVE-2022-31101 | High | 8.1 | 2022-06-27 | prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can p… |
CVE-2022-21686 | Critical | 9.0 | 2022-01-26 | PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside… |
CVE-2012-20001 | Medium | 6.1 | 2021-12-21 | PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field. |
CVE-2021-43789 | High | 7.5 | 2021-12-07 | PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters wit… |
CVE-2021-21418 | Medium | 4.6 | 2021-03-31 | ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that… |
CVE-2021-21398 | Medium | 5.4 | 2021-03-30 | PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type Dat… |
CVE-2021-21308 | Medium | 6.1 | 2021-02-26 | PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is ab… |
CVE-2021-21302 | Medium | 6.8 | 2021-02-26 | PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using sho… |
CVE-2021-3110 | Critical | 9.8 | 2021-01-20 | The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter. |
CVE-2020-26248 | Medium | 6.8 | 2020-12-03 | In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The prob… |
CVE-2020-26225 | High | 8.7 | 2020-11-16 | In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The… |
CVE-2020-26224 | High | 7.5 | 2020-11-16 | In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows… |
CVE-2020-15162 | Medium | 5.4 | 2020-09-24 | In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious… |
CVE-2020-15160 | Critical | 9.8 | 2020-09-24 | PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location para… |
CVE-2020-15161 | Medium | 5.4 | 2020-09-24 | In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1… |
CVE-2020-15178 | High | 8.0 | 2020-09-15 | In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The `mes… |
CVE-2020-15102 | Medium | 6.5 | 2020-07-21 | In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is… |
CVE-2020-4074 | High | 8.9 | 2020-07-02 | In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute adm… |
CVE-2020-15083 | Medium | 4.7 | 2020-07-02 | In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS. The problem is fixed in 1.7.6.6 |
CVE-2020-15082 | High | 7.1 | 2020-07-02 | In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fixed in 1.7.6.6 |
CVE-2020-15081 | Medium | 5.3 | 2020-07-02 | In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possib… |
CVE-2020-15080 | Medium | 5.3 | 2020-07-02 | In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible. The proble… |
CVE-2020-15079 | Medium | 6.4 | 2020-07-02 | In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module Positions. The probl… |
CVE-2020-11074 | Medium | 5.4 | 2020-07-02 | In PrestaShop from version 1.5.3.0 and before version 1.7.6.6, there is a stored XSS when using the name of a quick access item. The problem is fixed in 1.7.6… |
CVE-2020-12120 | High | 7.5 | 2020-04-27 | The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner password that can b… |
CVE-2020-5293 | Medium | 6.5 | 2020-04-20 | In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The… |
CVE-2020-5288 | Medium | 4.1 | 2020-04-20 | "In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5. |
CVE-2020-5287 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5. |
CVE-2020-5286 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.7.4.0 and 1.7.6.5, there is a reflected XSS when uploading a wrong file. The problem is fixed in 1.7.6.5 |
CVE-2020-5285 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is a reflected XSS with `back` parameter. The problem is fixed in 1.7.6.5 |
CVE-2020-5279 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.p… |
CVE-2020-5278 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.5.4.0 and 1.7.6.5, there is a reflected XSS on Exception page The problem is fixed in 1.7.6.5 |
CVE-2020-5276 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.7.1.0 and 1.7.6.5, there is a reflected XSS on AdminCarts page with `cartBox` parameter The problem is fixed in 1.7.6.5 |
CVE-2020-5272 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is a reflected XSS on Search page with `alias` and `search` parameters. The problem is patched in 1.7… |
CVE-2020-5271 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is a reflected XSS with `date_from` and `date_to` parameters in the dashboard page This problem is fi… |
CVE-2020-5270 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter. The impacts can be many, and vary from the theft of… |
CVE-2020-5269 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminFeatures page by using the `id_feature` parameter. The problem is fixed in… |
CVE-2020-5265 | Medium | 4.4 | 2020-04-20 | In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminAttributesGroups page. The problem is patched in 1.7.6.5. |
CVE-2020-5264 | Medium | 4.4 | 2020-04-20 | In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page. It allows anyone to execute arbitrary action. The p… |
CVE-2020-5294 | Medium | 4.1 | 2020-04-16 | PrestaShop module ps_facetedsearch versions before 2.1.0 has a reflected XSS with social networks fields The problem is fixed in 2.1.0 |
CVE-2020-5273 | Medium | 4.1 | 2020-04-16 | In PrestaShop module ps_linklist versions before 3.1.0, there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0 |
CVE-2020-5266 | Medium | 4.4 | 2020-04-16 | In the ps_link module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title field. The problem is… |
CVE-2020-5277 | Medium | 4.1 | 2020-03-25 | PrestaShop module ps_facetedsearch versions before 3.5.0 has a reflected XSS with `url_name` parameter. The problem is fixed in 3.5.0 |