PrestaShop core vulnerabilities

94 security advisories for the PrestaShop core, grouped by branch. An advisory appears under every branch it affects.

PrestaShop 9.x 10 PrestaShop 8.x 35 PrestaShop 1.7.x 53 PrestaShop 1.6.x 5 PrestaShop 1.5.x 3 PrestaShop 1.4.x 7

PrestaShop 9.x · 10

IDAdvisorySeverityAffected versionsPublishedFix

CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows… Medium 6.9 ≥ 8.0.0 < 8.2.8
≥ 9.0.0 < 9.1.5 2026-09-07 No

GHSA-jf3w-9rmr-5rcr Improper access control on the back-office notifications endpoint exposes customer data Medium 4.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

GHSA-whxq-pxj5-qq7v SQL injection through back-office list filters Medium 6.5 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

GHSA-2cr4-vw9p-pjvf Client IP address can be spoofed through the X-Forwarded-For header High 7.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

GHSA-xrwj-pq6w-f8m4 Server-Side Request Forgery through image URLs in the CSV import High 8.2 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

GHSA-w6j9-q9rq-wrqg Formula injection in CSV exports (CSV injection) High 8.0 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

CVE-2026-44212 CWE-79: Stored XSS executable in customer service view Critical 9.3 ≤ 1.7.8.11
< 8.2.6
< 9.1.1 2026-05-14 Yes

CVE-2026-33673 CWE 79: Prevent multiple stored xss exploitation via unprotected variables in template High 7.6 < 8.2.5
≥ 9.0.0 < 9.1.0 2026-03-26 Yes

CVE-2026-33674 Fix improper use of validation framework (CWE-1173) Medium 5.3 < 8.2.5
≥ 9.0.0 < 9.1.0 2026-03-26 Yes

CVE-2026-25597 Time based enumeration in FO login form Medium 5.3 < 8.2.4
≥ 9.0.0 < 9.0.3 2026-02-06 Yes

PrestaShop 8.x · 35

IDAdvisorySeverityAffected versionsPublishedFix

CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows… Medium 6.9 ≥ 8.0.0 < 8.2.8
≥ 9.0.0 < 9.1.5 2026-09-07 No

GHSA-jf3w-9rmr-5rcr Improper access control on the back-office notifications endpoint exposes customer data Medium 4.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

GHSA-whxq-pxj5-qq7v SQL injection through back-office list filters Medium 6.5 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

GHSA-2cr4-vw9p-pjvf Client IP address can be spoofed through the X-Forwarded-For header High 7.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

GHSA-xrwj-pq6w-f8m4 Server-Side Request Forgery through image URLs in the CSV import High 8.2 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

GHSA-w6j9-q9rq-wrqg Formula injection in CSV exports (CSV injection) High 8.0 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

CVE-2026-14846 In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by… Medium 4.5 = 8.2.1 2026-07-13 No

CVE-2026-44212 CWE-79: Stored XSS executable in customer service view Critical 9.3 ≤ 1.7.8.11
< 8.2.6
< 9.1.1 2026-05-14 Yes

CVE-2026-33673 CWE 79: Prevent multiple stored xss exploitation via unprotected variables in template High 7.6 < 8.2.5
≥ 9.0.0 < 9.1.0 2026-03-26 Yes

CVE-2026-33674 Fix improper use of validation framework (CWE-1173) Medium 5.3 < 8.2.5
≥ 9.0.0 < 9.1.0 2026-03-26 Yes

CVE-2026-25597 Time based enumeration in FO login form Medium 5.3 < 8.2.4
≥ 9.0.0 < 9.0.3 2026-02-06 Yes

CVE-2025-51586 Email enumeration Low 3.7 < 8.2.1 2025-09-08 Yes

CVE-2025-25692 A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute… Medium 6.5 = 8.2.0 2025-07-30 No

CVE-2025-25691 A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute… Medium 6.5 = 8.2.0 2025-07-30 No

CVE-2025-1230 Stored Cross-Site Scripting (XSS) vulnerability in Prestashop 8.1.7, due to the lack of proper validation of user… Medium 4.8 = 8.1.7 2025-02-12 No

CVE-2024-36626 In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php. Medium 5.3 = 8.1.4 2024-11-29 Yes

CVE-2024-41651 An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade… Critical 9.8 ≤ 8.1.7 2024-08-12 No

CVE-2024-34716 XSS via customer contact form in FO, through file upload Critical 9.6 ≥ 8.1.0 < 8.1.6 2024-05-14 Yes

CVE-2024-34717 Anonymous customer can download other customers's invoices Medium 5.3 = 8.1.5 2024-05-14 Yes

CVE-2024-26129 Path disclosure in JavaScript variable Medium 5.8 ≥ 8.1.0 < 8.1.4 2024-02-19 Yes

CVE-2024-21628 XSS can be stored in DB from "add a message form" in order detail page (FO) Medium 6.1 < 8.1.3 2024-01-02 Yes

CVE-2024-21627 Some attribute not escaped in Validate::isCleanHTML method High 8.1 < 1.7.8.11
≥ 8.0.0 < 8.1.3 2024-01-02 Yes

CVE-2023-43663 Uninstall modules from backoffice, even with low rights Medium 6.3 < 8.1.2 2023-09-28 Yes

CVE-2023-43664 Employee without any access rights can list all installed modules Medium 4.3 < 8.1.2 2023-09-28 Yes

CVE-2023-39524 SQL injection possible in search product in BO Critical 9.8 < 8.1.1 2023-08-07 Yes

CVE-2023-39525 path traversal: file deletion Critical 9.1 < 8.1.1 2023-08-07 Yes

CVE-2023-39526 SQL manager vulnerability (potential RCE) Critical 9.8 < 1.7.8.10
≥ 8.0.0 < 8.0.5
= 8.1.0 2023-08-07 Yes

CVE-2023-39527 New possible XSS injection through Validate::isCleanHTML method High 8.3 < 1.7.8.10
≥ 8.0.0 < 8.0.5
= 8.1.0 2023-08-07 Yes

CVE-2023-39528 Reading a file through path traversal High 8.6 < 8.1.1 2023-08-07 Yes

CVE-2023-39529 File deletion via attachment API Critical 9.1 < 8.1.1 2023-08-07 Yes

CVE-2023-39530 File deletion via CustomerMessage Critical 9.1 < 8.1.1 2023-08-07 Yes

CVE-2023-30545 Arbitrary file read High 7.7 < 1.7.8.9
≥ 8.0.0 < 8.0.4 2023-04-25 Yes

CVE-2023-30838 Possible XSS injection through Validate::isCleanHTML method Critical 9.9 < 1.7.8.9
≥ 8.0.0 < 8.0.4 2023-04-25 Yes

CVE-2023-30839 SQL filter bypass leading to arbitrary write requests using "SQL Manager" Critical 9.9 < 1.7.8.9
≥ 8.0.0 < 8.0.4 2023-04-25 Yes

CVE-2023-25170 Possible CSRF token fixation High 8.8 < 8.0.1 2023-03-13 Yes

PrestaShop 1.7.x · 53

IDAdvisorySeverityAffected versionsPublishedFix

CVE-2026-44212 CWE-79: Stored XSS executable in customer service view Critical 9.3 ≤ 1.7.8.11
< 8.2.6
< 9.1.1 2026-05-14 Yes

CVE-2024-21627 Some attribute not escaped in Validate::isCleanHTML method High 8.1 < 1.7.8.11
≥ 8.0.0 < 8.1.3 2024-01-02 Yes

CVE-2023-39526 SQL manager vulnerability (potential RCE) Critical 9.8 < 1.7.8.10
≥ 8.0.0 < 8.0.5
= 8.1.0 2023-08-07 Yes

CVE-2023-39527 New possible XSS injection through Validate::isCleanHTML method High 8.3 < 1.7.8.10
≥ 8.0.0 < 8.0.5
= 8.1.0 2023-08-07 Yes

CVE-2023-30545 Arbitrary file read High 7.7 < 1.7.8.9
≥ 8.0.0 < 8.0.4 2023-04-25 Yes

CVE-2023-30838 Possible XSS injection through Validate::isCleanHTML method Critical 9.9 < 1.7.8.9
≥ 8.0.0 < 8.0.4 2023-04-25 Yes

CVE-2023-30839 SQL filter bypass leading to arbitrary write requests using "SQL Manager" Critical 9.9 < 1.7.8.9
≥ 8.0.0 < 8.0.4 2023-04-25 Yes

CVE-2022-46158 Potential Information exposure in the upload directory Medium 5.3 < 1.7.8.8 2022-12-08 Yes

CVE-2022-31181 Chain: SQL Injection (CWE-89) and Eval Injection (CWE-95) Critical 9.8 ≥ 1.6.0.10 < 1.7.8.7 2022-08-01 Yes

CVE-2020-21967 File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code… Medium 4.8 = 1.7.6.7 2022-07-13 No

CVE-2022-21686 Server Side Twig Template Injection Critical 9.8 ≥ 1.7.0.0 ≤ 1.7.8.3 2022-01-26 Yes

CVE-2021-43789 Blind SQLi using Search filters Critical 9.8 ≥ 1.7.5.0 < 1.7.8.2 2021-12-07 Yes

CVE-2021-21398 Possible XSS injection through DataColumn Grid class Medium 5.4 ≥ 1.7.7.0 < 1.7.7.3 2021-03-30 Yes

CVE-2021-21302 CSV Injection via csv export High 7.2 < 1.7.7.2 2021-02-26 Yes

CVE-2021-21308 Improper session management for soft logout Critical 9.1 < 1.7.7.2 2021-02-26 Yes

CVE-2021-3110 The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments… Critical 9.8 = 1.7.7.0 2021-01-20 No

CVE-2020-26224 Improper Access Control with submitReorder function High 7.5 < 1.7.6.9 2020-11-16 Yes

CVE-2020-15160 Blind SQLi in Catalog Product edition Critical 9.8 ≥ 1.7.5.0 < 1.7.6.8 2020-09-24 Yes

CVE-2020-15161 Potential XSS injection with contact form Medium 6.1 ≥ 1.6.0.4 < 1.7.6.8 2020-09-24 Yes

CVE-2020-15162 Stored XSS in upload files Medium 5.4 ≥ 1.5.0.0 < 1.7.6.8 2020-09-24 Yes

CVE-2020-11074 Stored XSS in AdminQuickAccesses Medium 5.4 < 1.7.6.6 2020-07-02 Yes

CVE-2020-15079 Improper access control Medium 6.4 < 1.7.6.6 2020-07-02 Yes

CVE-2020-15080 Information disclosure in release archive Medium 5.3 < 1.7.6.6 2020-07-02 Yes

CVE-2020-15081 Information exposure in the upload directory Medium 5.3 < 1.7.6.6 2020-07-02 Yes

CVE-2020-15082 External control of configuration setting in the dashboard High 8.8 ≥ 1.6.0.1 < 1.7.6.6 2020-07-02 Yes

CVE-2020-15083 Reflected XSS when uploading an image in the Product page Medium 6.1 < 1.7.6.6 2020-07-02 Yes

CVE-2020-4074 Improper Authentication Critical 10.0 ≥ 1.5.0.0 < 1.7.6.6 2020-07-02 Yes

CVE-2020-5264 Reflected XSS in security compromised page Medium 6.1 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5265 Reflected XSS on AdminAttributesGroups page Medium 6.1 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5269 Reflected XSS on AdminFeatures page Medium 6.1 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5270 Open redirection when using back parameter Medium 6.1 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5271 Reflected XSS with dashboard calendar Medium 6.1 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5272 Reflected XSS on Search page Medium 6.1 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5276 Reflected XSS on AdminCarts page Medium 6.1 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5278 Reflected XSS on Exception page Medium 6.1 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5279 Improper Access Control Medium 6.5 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5285 Reflected XSS with back parameter Medium 6.1 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5286 Reflected XSS related in import page Medium 6.1 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5287 Improper access control on customers search Medium 6.5 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5288 Improper access control on product attributes page Medium 6.5 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5293 Improper access control on product page with combinations, attachments and specific prices Medium 6.5 < 1.7.6.5 2020-04-20 Yes

CVE-2020-5250 Possible information steal High 7.6 ≥ 1.7.0.0 < 1.7.6.4 2020-03-05 Yes

CVE-2020-6632 In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. Medium 6.1 = 1.7.6.2 2020-01-09 Yes

CVE-2019-13461 In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an… High 7.5 ≤ 1.7.5.2 2019-07-09 No

CVE-2019-11876 In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected… Medium 6.1 = 1.7.5.2 2019-05-24 No

CVE-2018-20717 In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with… High 8.8 < 1.7.2.5 2019-01-15 No

CVE-2018-19124 PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary… High 7.5 ≥ 1.6.0.1 < 1.6.1.23
≥ 1.7.0.0 < 1.7.4.4 2018-11-09 Yes

CVE-2018-19125 PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory. High 7.5 ≥ 1.6.0.1 < 1.6.1.23
≥ 1.7.0.0 < 1.7.4.4 2018-11-09 Yes

CVE-2018-19126 PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file… Critical 9.8 ≥ 1.6.0.1 < 1.6.1.23
≥ 1.7.0.0 < 1.7.4.4 2018-11-09 Yes

CVE-2018-13784 PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and… Critical 9.1 < 1.6.1.20
≥ 1.7.0.0 < 1.7.3.4 2018-07-09 No

CVE-2018-7491 In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing… High 7.5 ≤ 1.7.2.5 2018-02-26 No

CVE-2018-5681 PrestaShop 1.7.2.4 has XSS via source-code editing on the "Pages > Edit page" screen. Medium 5.4 = 1.7.2.4 2018-01-13 No

CVE-2018-5682 PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not… Medium 5.3 = 1.7.2.4 2018-01-13 No

PrestaShop 1.6.x · 5

IDAdvisorySeverityAffected versionsPublishedFix

CVE-2018-19125 PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory. High 7.5 ≥ 1.6.0.1 < 1.6.1.23
≥ 1.7.0.0 < 1.7.4.4 2018-11-09 Yes

CVE-2018-13784 PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and… Critical 9.1 < 1.6.1.20
≥ 1.7.0.0 < 1.7.3.4 2018-07-09 No

CVE-2015-1175 Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in the blocklayered module in PrestaShop 1.6.0.9 and… Medium 4.3 ≤ 1.6.0.9 2015-01-22 No

PrestaShop 1.5.x · 3

IDAdvisorySeverityAffected versionsPublishedFix

CVE-2012-20001 PrestaShop before 1.5.2 allows XSS via the " Medium 6.1 < 1.5.2 2021-12-21 No

CVE-2013-6295 PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module Critical 9.8 = 1.5.5.0 2020-02-18 No

CVE-2013-6358 PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and… Critical 9.0 = 1.5.5.0 2020-01-23 No

PrestaShop 1.4.x · 7

IDAdvisorySeverityAffected versionsPublishedFix

CVE-2013-4791 PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent… Medium 5.4 < 1.4.11 2020-02-14 No

CVE-2013-4792 PrestaShop before 1.4.11 allows logout CSRF. Medium 5.5 < 1.4.11 2020-02-14 No

CVE-2012-2517 Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web… Medium 6.1 < 1.4.9.0 2020-02-11 No

CVE-2012-6641 Cross-site scripting (XSS) vulnerability in redirect.php in the Socolissimo module (modules/socolissimo/) in… Medium 4.3 ≤ 1.4.7.1
= 1.4.0.1
= 1.4.0.2
+25 2014-04-07 No

CVE-2011-4545 CRLF injection vulnerability in admin/displayImage.php in Prestashop 1.4.4.1 allows remote attackers to inject… Medium 5.0 = 1.4.4.1 2011-12-02 No

CVE-2011-4544 Multiple cross-site scripting (XSS) vulnerabilities in Prestashop before 1.5 allow remote attackers to inject… Medium 4.3 ≤ 1.4.0.6
= 0.8.1
= 0.8.2
+17 2011-12-01 No

CVE-2011-3796 PrestaShop 1.4.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which… Medium 5.0 = 1.4.0.6 2011-09-24 No

Branch not determined · 2

IDAdvisorySeverityAffected versionsPublishedFix

CVE-2008-6503 Multiple cross-site scripting (XSS) vulnerabilities in PrestaShop 1.1.0.3 allow remote attackers to inject arbitrary… Medium 4.3 = 1.1.0.3 2009-03-20 No

CVE-2008-5791 Multiple unspecified vulnerabilities in PrestaShop e-Commerce Solution before 1.1 Beta 2 (aka 1.1.0.1) have unknown… Critical 10.0 ≤ 1.0
= 0.8.1
= 0.8.2
+14 2008-12-31 Yes

Stop checking the list by hand

PrestaShield knows the modules and version of your shop, checks them against this database and alerts you as soon as an advisory that affects you is published. No FTP access, no customer data.

Monitor my shop automatically