Priority MEDIUM 57
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00342 · Published 2026-09-16 · No fix listed CWE-639
Priority MEDIUM 57
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00354 · Published 2026-09-16 · No fix listed CWE-639
Priority LOW 37
Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running beh…
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00541 · Published 2026-09-07 · Fixed in 9.1.5, 8.2.8 CWE-290
Priority MEDIUM 50
PrestaShop ps_facetedsearch is a module that adds layered navigation filters.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.0075 · Published 2026-07-17 · Fixed in 4.0.4 CWE-74
Priority LOW 21
In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function.
CVSS 4.0MEDIUM 4.5· Network · High privileges · User interaction · EPSS 0.00425 · Published 2026-07-13 · No fix listed CWE-1236
Priority MEDIUM 42
PrestaShop is an open source e-commerce web application.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00425 · Published 2026-05-14 · Fixed in 8.2.6, 9.1.1 CWE-79
Priority LOW 24
PrestaShop is an open source e-commerce web application.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00246 · Published 2026-03-26 · Fixed in 8.2.5, 9.1.0 CWE-1173
Priority LOW 35
PrestaShop is an open source e-commerce web application.
CVSS 3.1HIGH 7.7· Network · High privileges · User interaction · EPSS 0.00275 · Published 2026-03-26 · Fixed in 9.1.0, 8.2.5 CWE-79
Priority LOW 30
PrestaShop is an open source e-commerce web application.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00312 · Published 2026-02-06 · Fixed in 8.2.4, 9.0.3 CWE-208
Priority LOW 18
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal.
CVSS 3.1LOW 3.8· Network · High privileges · No interaction · EPSS 0.00269 · Published 2025-10-16 · Fixed in 4.4.1, 5.0.5 CWE-184
Priority LOW 21
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal.
CVSS 3.1MEDIUM 4.1· Network · High privileges · No interaction · EPSS 0.0092 · Published 2025-10-16 · Fixed in 4.4.1, 5.0.5 CWE-22
Priority MEDIUM 48
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00503 · Published 2025-10-16 · Fixed in 4.4.1, 5.0.5 CWE-287
Priority MEDIUM 51
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00849 · Published 2025-09-08 · Fixed in 8.2.3 CWE-359
Priority MEDIUM 64
A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00731 · Published 2025-07-30 · No fix listed CWE-502
Priority LOW 33
A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00931 · Published 2025-07-30 · No fix listed CWE-502
Priority LOW 22
Stored Cross-Site Scripting (XSS) vulnerability in Prestashop 8.1.7, due to the lack of proper validation of user input through ‘/<admin_directory>/index.php’, affecting the ‘link’ parameter.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00265 · Published 2025-02-12 · No fix listed CWE-79
Priority LOW 30
ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting (XSS) vulnerability in versions up to and including 3.3.2.
CVSS 3.1MEDIUM 6.2· Network · High privileges · No interaction · EPSS 0.00423 · Published 2025-01-22 · Fixed in 3.3.3 CWE-79
Priority LOW 31
In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00655 · Published 2024-11-29 · No fix listed CWE-476
Priority HIGH 82
An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01263 · Published 2024-08-12 · No fix listed CWE-94
Priority MEDIUM 49
In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00408 · Published 2024-06-19 · No fix listed CWE-89
Priority LOW 31
PrestaShop is an open source e-commerce web application.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00525 · Published 2024-05-14 · Fixed in 8.1.6 CWE-200
Priority HIGH 76
PrestaShop is an open source e-commerce web application.
CVSS 3.1CRITICAL 9.7· Network · No auth · User interaction · EPSS 0.56445 · Published 2024-05-14 · Fixed in 8.1.6 CWE-79
Priority MEDIUM 44
SQL injection vulnerability in pscartabandonmentpro v.2.0.11 and before allows a remote attacker to escalate privileges via the pscartabandonmentproFrontCAPUnsubscribeJobModuleFrontController::setEmailVisualized() method…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00619 · Published 2024-03-20 · No fix listed CWE-89
Priority MEDIUM 50
In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00574 · Published 2024-02-27 · No fix listed CWE-89
Priority LOW 33
PrestaShop is an open-source e-commerce platform.
CVSS 3.1MEDIUM 5.8· Network · No auth · No interaction · EPSS 0.0061 · Published 2024-02-19 · Fixed in 8.1.4 CWE-22
Load more
THREATIST.IORead the docs