Log in Start free

PrestaShop

Products

ProductCVEsExploitedLatest
PrestaShop57–Sep 7, 2026
productcomments3–Sep 2, 2022
ps_facetedsearch2–Jul 17, 2026
blockwishlist2–Sep 16, 2026
blockreassurance2–Nov 9, 2023
ps_linklist2–Apr 16, 2020
M4 PDF plugin2–Sep 20, 2023
The firmware1–Jul 13, 2026
contactform1–Sep 15, 2020
dashproducts1–Jul 21, 2020
ps_contactinfo1–Jan 22, 2025
ps_emailsubscription1–Mar 31, 2021
ps_socialfollow1–Apr 16, 2020
psgdpr1–Sep 16, 2026

Exploited and recent CVEs

  • CVE-2026-92810 Medium 4.3 PrestaShop blockwishlist through 3.0.2 Information Disclosure 0.3%
  • CVE-2026-92809 Medium 4.3 PrestaShop psgdpr through 1.4.3 GDPR Log Forgery 0.4%
  • CVE-2026-84186 Medium 6.9 Incorrect access control in PrestaShop 0.5%
  • CVE-2026-54159 Critical 10.0 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE 0.8%
  • CVE-2026-14846 Medium 4.5 Incorrect neutralisation in the PrestaShop firmware 0.4%
  • CVE-2026-44212 Critical 9.3 PrestaShop: Stored XSS executable in customer service view 0.4%
  • CVE-2026-33674 Low 2.0 PrestaShop: Improper Use of Validation Framework 0.2%
  • CVE-2026-33673 High 7.7 PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables 0.3%
  • CVE-2026-25597 Medium 5.3 PrestaShop has a time based enumeration in FO login form 0.3%
  • CVE-2025-1230 Medium 4.8 Cross-Site Scripting (XSS) vulnerability in Prestashop 0.3%
  • CVE-2025-24027 Medium 6.2 ps_contactinfo has potential XSS due to usage of the nofilter tag in template 0.4%
  • CVE-2024-34717 Medium 5.3 Anonymous PrestaShop customer can download other customers' invoices 0.5%
  • CVE-2024-34716 Critical 9.7 PrestaShop vulnerable to XSS via customer contact form in FO, through file upload 56.4%
  • CVE-2024-26129 Medium 5.8 Prestashop vulnerable to path disclosure in JavaScript variable 0.6%
  • CVE-2024-21628 Medium 5.4 XSS can be stored in DB from "add a message form" in order detail page (FO) 0.4%
  • CVE-2024-21627 High 8.1 Some attribute not escaped in Validate::isCleanHTML method 0.5%
  • CVE-2023-47110 Critical 9.1 Any value can be changed in the configuration table by an employee having access to block reassurance module 0.4%
  • CVE-2023-47109 Medium 5.5 PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block 0.8%
  • CVE-2023-43664 Medium 4.3 Employee without any access rights can list all installed modules in Prestashop 0.5%
  • CVE-2023-43663 Medium 6.3 Improper Privilege Management in Prestashop 0.4%
  • CVE-2022-45448 Low 3.5 Cross-site Scripting in M4 PDF plugin for Prestashop sites 0.3%
  • CVE-2022-45447 Medium 6.5 Path Traversal in M4 PDF plugin for Prestashop sites 0.9%
  • CVE-2023-39530 Medium 6.5 PrestaShop vulnerable to file deletion via CustomerMessage 0.9%
  • CVE-2023-39529 Medium 6.7 PrestaShop vulnerable to file deletion via attachment API 0.7%
  • CVE-2023-39528 Medium 6.8 PrestaShop vulnerable to file reading through path traversal 0.8%
  • CVE-2023-39527 High 8.3 PrestaShop XSS vulnerability through Validate::isCleanHTML method 0.5%
  • CVE-2023-39526 Critical 9.1 PrestaShopSQL manager vulnerability (potential RCE) 1.7%
  • CVE-2023-39525 Medium 6.5 PrestaShop vulnerable to path traversal 0.9%
  • CVE-2023-39524 Medium 6.7 PrestaShop vulnerable to boolean SQL injection in search product in BO 0.7%
  • CVE-2023-30839 Critical 10.0 PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager" 1.7%