shopperlabs

Records17All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

shopperlabs records in CISA KEV

No shopperlabs vulnerabilities are listed in CISA KEV.

Records

17 records

TI-2026-83413 CVE-2026-62990

Stored XSS via SVG and HTML uploads in Shopper admin panel

HIGH 73

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00243 Published 2026-10-30 Fixed in 2.10.1, 3.0.0-beta.3 CWE-269

TI-2026-40978 CVE-2026-56827 · GHSA-243p-f3cv-c5wh

Missing authorization in shopperlabs shopper

HIGH 70

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00504 Published 2026-09-15 Fixed in 2.9.2 CWE-862

TI-2026-83412 CVE-2026-62989

Missing authorization in Shopper lets staff delete product variants

HIGH 68

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00279 Published 2026-10-30 Fixed in 2.10.0 CWE-285

TI-2026-40979 CVE-2026-56829 · GHSA-g3f9-g5vj-p62f

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

HIGH 68

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00504 Published 2026-09-15 Fixed in 2.9.2 CWE-862

TI-2026-40977 CVE-2026-56825 · GHSA-2cg9-97gq-9mqp

Shopper: Missing authorization on product removal actions in CollectionProducts component

HIGH 68

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00504 Published 2026-09-15 Fixed in 2.9.2 CWE-862

TI-2026-40981 CVE-2026-56831 · GHSA-5vf4-452p-jjhf

Shopper: Negative discount values accepted and propagated through order calculation pipeline

MEDIUM 62

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00435 Published 2026-09-15 Fixed in 2.9.0 CWE-20

TI-2026-35241 CVE-2026-47741 · GHSA-9rh9-hf3w-9fgg

Shopper: Race condition on Discount.usage_limit allows silent over-redemption

MEDIUM 60

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00239 Published 2026-05-29 Fixed in 2.8.0 CWE-362

TI-2026-73472 CVE-2026-56826

Missing authorization in Shopper lets users delete store settings

MEDIUM 58

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00338 Published 2026-10-13 Fixed in 2.9.2 CWE-862

TI-2026-35244 CVE-2026-47744 · GHSA-c3qp-2ggw-xjg7

Shopper: Authorization bypass and RBAC privilege escalation in team settings

MEDIUM 43

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00321 Published 2026-05-29 Fixed in 2.8.0 CWE-269

TI-2026-82004 CVE-2026-56828

Missing authorization in Shopper team settings lets staff escalate privileges

MEDIUM 40

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00441 Published 2026-10-28 Fixed in 2.8.1, 2.9.2 CWE-285

TI-2026-78768 CVE-2026-114387 · GHSA-6wfw-fw32-2h84

Missing authorization in Shopper lets dashboard users create administrators

MEDIUM 40

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00324 Published 2026-10-21 Fixed in 2.6.0 CWE-862

TI-2026-35243 CVE-2026-47743 · GHSA-hr9v-r8r2-hg7j

Shopper: Multiple data integrity and disclosure issues in admin Livewire components

MEDIUM 40

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00384 Published 2026-07-23 Fixed in 2.8.0 CWE-200

TI-2026-35240 CVE-2026-47740 · GHSA-f946-9qp6-vgch

Shopper: Authorization bypass in multiple Livewire admin components

LOW 37

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-05-29 Fixed in 2.8.0 CWE-285

TI-2026-40980 CVE-2026-56830 · GHSA-99h5-jhh7-v3r3

Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

LOW 29

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2026-09-15 Fixed in 2.9.2 CWE-862

TI-2026-83414 CVE-2026-62991

Authorization bypass in Shopper exposes staff and admin records

LOW 28

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00238 Published 2026-10-30 Fixed in 2.10.1 CWE-639

TI-2026-35245 CVE-2026-47745 · GHSA-fxqw-97cc-7g5c

Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables

LOW 28

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00221 Published 2026-05-29 Fixed in 2.8.0 CWE-862

TI-2026-35242 CVE-2026-47742 · GHSA-h4mp-g9c6-xwph

Shopper: Missing authorization on Product admin Livewire sub-form components

LOW 28

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00221 Published 2026-05-29 Fixed in 2.8.0 CWE-862

Open these records in search →

Critical	1
High	9
Medium	7
Low	0
No CVSS	0