ESLog inGet started free
Public PrestaShop vulnerability database

Protect your PrestaShop with the largest vulnerability database

Security advisories for the core and the modules in one place, with severity, affected versions and what to do. Made for shop owners, agencies and developers.

Examples: CVE-2025-61922 · GHSA-jf3w-9rmr-5rcr · ps_facetedsearch · 8.2.3

385published advisories
193critical (≥ 9.0)
97high (7.0–8.9)
91medium (4.0–6.9)
94 core · 259 modules2 low · 2 unscored · 32 other
2026-10-30latest advisory

Latest critical advisories

See all critical (193)

All advisories

Fix
Active filters: Showing 0 of 385
IDAdvisoryComponentSeverityAffected versionsPublishedFix
PSV-2026-0001 LiteSpeed Cache: unauthenticated code execution through ESI litespeedcache Critical 9.8 < 1.6.2 2026-10-30 Yes
GHSA-pg6j-qf29-gc43 CSV Injection (Formula Injection) in newsletter subscribers export ps_emailsubscription Medium 6.1 < 3.0.1 2026-10-28 Yes
CVE-2026-109619 PHP has various global state that temporarily points into request memory. PHP Critical 9.2 ≥ 5.4.0 < 8.2.35
≥ 8.3.0 < 8.3.36
≥ 8.4.0 < 8.4.27
+1 2026-10-21 No
CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. PHP Critical 9.8 ≥ 7.3.0 < 8.2.35
≥ 8.3.0 < 8.3.36
≥ 8.4.0 < 8.4.27
+1 2026-10-21 No
CVE-2026-85520 Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in… gmfeed Critical 9.3 ≥ 1.9.1 < 2.3.9 2026-09-29 No
CVE-2026-91765 cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. PHP High 7.5 ≥ 8.2.0 < 8.2.34
≥ 8.3.0 < 8.3.35
≥ 8.4.0 < 8.4.26
+1 2026-09-25 No
CVE-2026-92810 PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method,… blockwishlist Medium 5.3 ≤ 3.0.2 2026-09-16 No
CVE-2026-92809 IDOR — Authenticated customers can forge GDPR consent records for arbitrary customers (psgdpr 1.4.3) psgdpr Medium 5.3 ≤ 1.4.3 2026-09-16 Yes
GHSA-w68x-wjp2-mwc9 Authenticated SQL injection in the productcomments module productcomments High 7.2 ≥ 6.0.0 < 8.0.1 2026-09-11 Yes
CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows… Core Medium 6.9 ≥ 8.0.0 < 8.2.8
≥ 9.0.0 < 9.1.5 2026-09-07 No
CVE-2026-38725 xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript… xipblog Medium 5.4 ≤ 2.0.1 2026-08-28 No
GHSA-jf3w-9rmr-5rcr Improper access control on the back-office notifications endpoint exposes customer data Core Medium 4.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes
GHSA-whxq-pxj5-qq7v SQL injection through back-office list filters Core Medium 6.5 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes
GHSA-2cr4-vw9p-pjvf Client IP address can be spoofed through the X-Forwarded-For header Core High 7.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes
GHSA-xrwj-pq6w-f8m4 Server-Side Request Forgery through image URLs in the CSV import Core High 8.2 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes
GHSA-w6j9-q9rq-wrqg Formula injection in CSV exports (CSV injection) Core High 8.0 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes
CVE-2026-50986 PrestaShop module, totadministrativemandate totadministrativemandate High 8.8 ≤ 1.8.1 2026-07-31 No
CVE-2026-17544 Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP… PHP Critical 9.8 ≥ 8.4.0 < 8.4.24
≥ 8.5.0 < 8.5.9 2026-07-30 No
CVE-2026-17543 Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions… PHP Critical 9.8 ≥ 8.2.0 < 8.2.33
≥ 8.3.0 < 8.3.33
≥ 8.4.0 < 8.4.24
+1 2026-07-30 No
CVE-2026-54159 PHP Object Injection in faceted search cache allows unauthenticated RCE ps_facetedsearch Critical 10.0 ≥ 3.0.0 < 4.0.4 2026-07-17 Yes
CVE-2026-14846 In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by… Core Medium 4.5 = 8.2.1 2026-07-13 No
CVE-2026-39079 Sensitive data exposure via publicly accessible logs in upsshipping module from Agence Web 360 for PrestaShop upsshipping High 7.5 — 2026-05-18 No
CVE-2026-44212 CWE-79: Stored XSS executable in customer service view Core Critical 9.3 ≤ 1.7.8.11
< 8.2.6
< 9.1.1 2026-05-14 Yes
CVE-2026-7263 In PHP versions 8.4. before 8.4.21 and 8.5. PHP High 7.5 ≥ 8.4.0 < 8.4.21
≥ 8.5.0 < 8.5.6 2026-05-10 No
CVE-2026-6104 In PHP versions 8.4. before 8.4.21 and 8.5. PHP Critical 9.1 ≥ 8.4.0 < 8.4.21
≥ 8.5.0 < 8.5.6 2026-05-10 No

Where the data comes from

Advisories from the PrestaShop security team on GitHub (GHSA), CVE records from NVD and Friends of Presta advisories, merged into a single record. Sources are checked daily; every record links to its origin.

Browse by component

All core advisories by PrestaShop branch, each module's advisories on its own page, and PHP's own advisories by branch.

Core advisories (94) · Advisories by module (209) · PHP advisories (29)

Public REST API

Query the database from your code

The same data as this site, as JSON and without a key. Filter by module or by core version, or check a whole shop in a single request.

  • One record per advisory: score, CVSS vector, affected versions, references and source
  • POST /v1/check: the core and every module of a shop at once
  • It is the API the PrestaShield connector uses to alert each shop
By module By core version One advisory 
# By module
GET https://api.prestashield.com/v1/vulnerabilities?type=module&slug=ps_facetedsearch&version=4.0.3

# By core version
GET https://api.prestashield.com/v1/vulnerabilities?type=core&version=8.2.3&lang=en

# One advisory
GET https://api.prestashield.com/v1/vulnerabilities/GHSA-jf3w-9rmr-5rcr

# POST /v1/check
POST https://api.prestashield.com/v1/check  {"ps_version":"8.2.1","modules":[{"slug":"ps_checkout","version":"4.4.0"}]}

Stop checking the list by hand

PrestaShield knows the modules and version of your shop, checks them against this database and alerts you as soon as an advisory that affects you is published. No FTP access, no customer data.

Monitor my shop automaticallyFree 2-minute external scan