Vulnerabilities

TI-2026-83414 CVE-2026-62991

Authorization bypass in Shopper exposes staff and admin records

LOW 28

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00238 Published 2026-10-30 Fixed in 2.10.1 CWE-639

TI-2026-83413 CVE-2026-62990

Stored XSS via SVG and HTML uploads in Shopper admin panel

HIGH 73

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00243 Published 2026-10-30 Fixed in 2.10.1, 3.0.0-beta.3 CWE-269

TI-2026-83412 CVE-2026-62989

Missing authorization in Shopper lets staff delete product variants

HIGH 68

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00279 Published 2026-10-30 Fixed in 2.10.0 CWE-285

TI-2026-82004 CVE-2026-56828

Missing authorization in Shopper team settings lets staff escalate privileges

MEDIUM 40

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00441 Published 2026-10-28 Fixed in 2.8.1, 2.9.2 CWE-285

TI-2026-78768 CVE-2026-114387 · GHSA-6wfw-fw32-2h84

Missing authorization in Shopper lets dashboard users create administrators

MEDIUM 40

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00324 Published 2026-10-21 Fixed in 2.6.0 CWE-862

TI-2026-73472 CVE-2026-56826

Missing authorization in Shopper lets users delete store settings

MEDIUM 58

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00338 Published 2026-10-13 Fixed in 2.9.2 CWE-862

TI-2026-40980 CVE-2026-56830 · GHSA-99h5-jhh7-v3r3

Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

LOW 29

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2026-09-15 Fixed in 2.9.2 CWE-862

TI-2026-40981 CVE-2026-56831 · GHSA-5vf4-452p-jjhf

Shopper: Negative discount values accepted and propagated through order calculation pipeline

MEDIUM 62

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00435 Published 2026-09-15 Fixed in 2.9.0 CWE-20

TI-2026-40978 CVE-2026-56827 · GHSA-243p-f3cv-c5wh

Missing authorization in shopperlabs shopper

HIGH 70

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00504 Published 2026-09-15 Fixed in 2.9.2 CWE-862

TI-2026-40979 CVE-2026-56829 · GHSA-g3f9-g5vj-p62f

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

HIGH 68

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00504 Published 2026-09-15 Fixed in 2.9.2 CWE-862

TI-2026-40977 CVE-2026-56825 · GHSA-2cg9-97gq-9mqp

Shopper: Missing authorization on product removal actions in CollectionProducts component

HIGH 68

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00504 Published 2026-09-15 Fixed in 2.9.2 CWE-862

TI-2026-35243 CVE-2026-47743 · GHSA-hr9v-r8r2-hg7j

Shopper: Multiple data integrity and disclosure issues in admin Livewire components

MEDIUM 40

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00384 Published 2026-07-23 Fixed in 2.8.0 CWE-200

TI-2026-35240 CVE-2026-47740 · GHSA-f946-9qp6-vgch

Shopper: Authorization bypass in multiple Livewire admin components

LOW 37

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-05-29 Fixed in 2.8.0 CWE-285

TI-2026-35241 CVE-2026-47741 · GHSA-9rh9-hf3w-9fgg

Shopper: Race condition on Discount.usage_limit allows silent over-redemption

MEDIUM 60

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00239 Published 2026-05-29 Fixed in 2.8.0 CWE-362

TI-2026-35242 CVE-2026-47742 · GHSA-h4mp-g9c6-xwph

Shopper: Missing authorization on Product admin Livewire sub-form components

LOW 28

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00221 Published 2026-05-29 Fixed in 2.8.0 CWE-862

TI-2026-35244 CVE-2026-47744 · GHSA-c3qp-2ggw-xjg7

Shopper: Authorization bypass and RBAC privilege escalation in team settings

MEDIUM 43

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00321 Published 2026-05-29 Fixed in 2.8.0 CWE-269

TI-2026-35245 CVE-2026-47745 · GHSA-fxqw-97cc-7g5c

Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables

LOW 28

Shopper is a Headless e-commerce Admin Panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00221 Published 2026-05-29 Fixed in 2.8.0 CWE-862

Vulnerabilities

Filters