PrestaShield Vulnerability API
A free, read-only JSON API over the largest database of PrestaShop vulnerabilities: core and modules, CVE and GHSA, with the affected version ranges you need to know whether a shop is exposed. It feeds the PrestaShield connector and panel, and you can use it too.
Basics
https://api.prestashield.com/v1 · JSON, UTF-8 · no auth · open CORS (Access-Control-Allow-Origin: *) · OpenAPI 3.0.
POST /v1/check is limited to 60 requests per minute per IP. Read endpoints are cached for 5 minutes; please cache on your side too and send a descriptive User-Agent (for example MyTool/1.2 (+https://example.com)).
Add lang=es or lang=en (default en) to get the headline, the summary and the affected ranges in that language. The long advisory text is served in the language of its source, usually English, with a translation when one exists.
PrestaShop versions have four numbers on the 1.x branch (1.7.8.11) and three from 8 on (8.2.1, 9.1.5). Module versions are whatever the module declares.
Endpoints
| Endpoint | What it returns |
|---|---|
GET /v1/vulnerabilities?type=core&version=8.2.1 | Core advisories affecting that version (all core advisories without version). |
GET /v1/vulnerabilities?type=module&slug=ps_facetedsearch&version=3.0.0 | Advisories of one module affecting that version. slug is the module's technical name (its folder). |
GET /v1/vulnerabilities?type=php&version=8.2.30 | Advisories for the PHP interpreter itself (recent, severe, excluding Windows-only ones) affecting that version. Only the numeric part is compared: "8.2.29-nmm1" works. |
GET /v1/vulnerabilities/{slug|CVE|GHSA} | One advisory with description, references, CWE and CVSS metrics. Any identifier works: cve-2026-44212, CVE-2026-44212, GHSA-w9f3-qc75-qgx9. |
POST /v1/check | Everything affecting one shop in a single call: the core, all its modules and, when php_version is sent, PHP itself. The recommended way to integrate. |
GET /v1/catalog?page=1&per_page=100 | The whole catalogue with full detail, paginated. Meant for builds and mirrors, not for per-request use. |
GET /v1/modules · GET /v1/modules/{slug} | Modules that have advisories, with counts; and all advisories of one module. |
GET /v1/connector/latest | Latest version of the veoprestashield connector and its ZIP. |
Check a whole shop
curl -X POST https://api.prestashield.com/v1/check \
-H "Content-Type: application/json" \
-H "User-Agent: MyTool/1.0 (+https://example.com)" \
-d '{"ps_version":"8.2.1","php_version":"8.2.30","lang":"en","modules":[{"slug":"ps_facetedsearch","version":"3.0.0"},{"slug":"productcomments","version":"4.1.0"}]}'{
"core": [ { "slug": "cve-2026-44212", "cve": "CVE-2026-44212", "score": 9.3, "severity": "critical",
"affected": ["…"], "url": "https://www.prestashield.com/en/vulnerabilities/cve-2026-44212/", "…": "…" } ],
"php": [ { "slug": "cve-2026-109618", "score": 9.2, "…": "…" } ],
"modules": { "ps_facetedsearch": [ { "slug": "cve-2026-54159", "score": 10, "…": "…" } ],
"productcomments": [ "…" ] },
"meta": { "ps_version": "8.2.1", "modules_checked": 2, "modules_vulnerable": 2, "generated_at": "2026-10-25T12:00:00+00:00" }
}Fields of an advisory
| Field | Meaning |
|---|---|
slug, cve, ghsa | Stable identifier (the URL one) and the public identifiers it maps to. A GHSA that later gets a CVE keeps its slug. |
type, module | core, module (+ technical name) or php (the interpreter; ranges are PHP versions). dependency and other exist for edge cases. |
score, severity | CVSS base score (highest available, v4 > v3.1 > v3.0) and its label: none, low (<4), medium (<7), high (<9), critical. |
ranges, affected | Machine-readable ranges and the same in plain words. A range has unique (exactly that version) or bounds: start (inclusive), included (inclusive upper), excluded (exclusive upper). Matching evaluates only the ranges of the installed major branch when there are any: with "< 8.2.6" and "< 9.1.1", an 8.2.7 shop is not affected. |
has_patch, patches | Whether a fix exists and, for core issues, modules that patch it without upgrading. |
back_office | Exploitable only with high privileges (an employee account): lower urgency than a front-office issue. |
url | Public page of the advisory on www.prestashield.com, in the requested language. |
description, references, weaknesses, metrics | Detail endpoints only. description is HTML; metrics follows NVD's structure for all sources. |
Where the data comes from
Three sources, merged into one record per advisory: NVD (CVE, CVSS, CPE ranges; refreshed continuously), the GitHub Security Advisories of the PrestaShop organisation (the vendor's own advisories, including those without a CVE) and Friends of Presta (third-party module advisories with the module's technical name). New entries are added daily; entries whose module cannot be identified automatically are reviewed by hand before they are published.
Found an error, a missing advisory or a wrong range? Write to hola@kebes.es.
Legacy WordPress endpoints
Connectors installed before the API moved still call /wp-json/wp/v2/vulnerability?vulnerability_core=true&version=… and ?vulnerability_module_slug=…&version=…. Those URLs keep working with the same response shape (title.rendered, content.rendered, acf.base_score), now backed by this database. They are deprecated: new integrations must use /v1.
Fair use and privacy
The API is free for any use, including commercial, as long as you don't hammer it: cache responses, batch with /v1/check, and use /v1/catalog for mirrors. For security and usage control we log each request (endpoint, parameters, IP address, origin host and user agent). Raw logs are deleted after 90 days; only aggregated counts without IP addresses are kept. Legal basis: legitimate interest (GDPR art. 6.1.f).
Changelog
2026-10 · v1 — New API on a dedicated backend with a single version-matching engine (per-branch ranges), three merged sources, POST /v1/check, catalogue and OpenAPI spec. The WordPress endpoints became a compatibility layer.