PrestaShop vulnerabilities
We track 37 vulnerabilities in PrestaShop products across 19 products. 37 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest PrestaShop vulnerabilities
- 8.1 High severity
PrestaShop: Incorrect Authorization
PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expand the shop c
- 8.1 High severity
PrestaShop: Authorization Bypass Through User-Controlled Key
PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing re
- 10.0 Critical severity
ps_facetedsearch: Improper Neutralization of Special Elements in Output Used by a Downstream Component
PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL wi
- 9.3 Critical severity
PrestaShop: Improper Neutralization of Input During Web Page Generation
PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form
- 9.1 Critical severity
ps_checkout: Improper Authentication
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via ema
- 8.1 High severity
prestashop: Server-Side Request Forgery
An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality. NOTE: this is disputed by multiple parties, who report that exploitation requires that an attacker be able to hijack network requ
- 8.8 High severity
helpdesk: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via 'Tickets::getsearchedtickets(
- 9.8 Critical severity
ask_for_a_quote: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <= 1.0.51 from Buy Addons for PrestaShop allows attackers to view sensitive information and cause other impacts via methods `Askforaquotemodul
- 10.0 Critical severity
m4_pdf: Improper Control of Generation of Code
PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate() method.
- 7.5 High severity
quadra_informatique: Exposure of Sensitive Information to an Unauthorized Actor
In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (expiry date) / postal address / email / etc. without restriction due to a lack of permissions control.
- 9.8 Critical severity
prestashop: Improper Neutralization of Special Elements used in an SQL Command
In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFProductListModuleFrontController::queryDb().'
- 10.0 Critical severity
livechatpro: Improper Control of Generation of Code
In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the method `Lcp::saveTranslations()` suffer of a white writer that can inject PHP code into a PHP file.
- 7.5 High severity
loginascustomerpro: Exposure of Private Personal Information to an Unauthorized Actor
In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer account of the Shop if the module is not installed OR if a secret accessible to administrator is stolen.
- 9.8 Critical severity
channable: Improper Neutralization of Special Elements used in an SQL Command
In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFeedModuleFrontController::postProcess()`.
- 10.0 Critical severity
helpdesk: Unrestricted Upload of File with Dangerous Type
In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. Methods `HelpdeskHelpdeskModuleFrontController::submitTicket()` and `HelpdeskHelpdeskModuleFrontCon
- 7.5 High severity
fme: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal vulnerability in FME Modules customfields v.2.2.7 and before allows a remote attacker to obtain sensitive information via the Custom Checkout Fields, Add Custom Fields to Checkout parameter of the ajax.php
- 7.5 High severity
prestashop: Out-of-bounds Read
An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote attacker to obtain sensitive information via the uploadfiles.php component.
- 9.8 Critical severity
prestashop: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a remote attacker to run arbitrary SQL commands via the PreorderModel::getIdProductAttributesByIdAttributes() method.
- 9.8 Critical severity
scalapay: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate privileges via the ScalapayReturnModuleFrontController::postProcess() method.
- 9.8 Critical severity
abandoned_cart_reminder_pro: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in pscartabandonmentpro v.2.0.11 and before allows a remote attacker to escalate privileges via the pscartabandonmentproFrontCAPUnsubscribeJobModuleFrontController::setEmailVisualized() method.
- 9.8 Critical severity
prestashop: Improper Neutralization of Special Elements used in an SQL Command
In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions.
- 9.8 Critical severity
import\/update_bulk_product_from_any_csv\/excel…: Improper Neutralization of Special Elements used in an SQL Command
In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions.
- 9.8 Critical severity
newsletter_popup_pro: Improper Neutralization of Special Elements used in an SQL Command
In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method `NewsletterpopsendVerificationModuleFrontController::checkE
- 8.1 High severity
blockreassurance: Improper Authorization
PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file
- 9.1 Critical severity
PrestaShop is an open source e-commerce web application.
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
- 9.1 Critical severity
PrestaShop is an open source e-commerce web application.
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known work
- 8.6 High severity
PrestaShop: Improper Limitation of a Pathname to a Restricted Directory
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 cont
- 9.8 Critical severity
PrestaShop: Improper Neutralization of Special Elements used in an SQL Command
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch
- 9.1 Critical severity
PrestaShop: Improper Limitation of a Pathname to a Restricted Directory
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.
- 9.8 Critical severity
PrestaShop: Improper Neutralization of Special Elements used in an SQL Command
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
- 9.8 Critical severity
Payplug: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers to execute arbitrary SQL commands via the ajax.php front controller.
- 8.8 High severity
PrestaShop: Improper Neutralization of Special Elements used in an SQL Command
PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 conta
- 9.9 Critical severity
PrestaShop: Improper Neutralization of Input During Web Page Generation
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) injection, allowed by the presence of pre
- 8.8 High severity
PrestaShop: Cross-Site Request Forgery
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, th
- 9.8 Critical severity
PrestaShop: Improper Neutralization of Special Elements used in an SQL Command
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7.
- 8.8 High severity
blockwishlist: Improper Neutralization of Special Elements used in an SQL Command
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are n
- 9.8 Critical severity
PrestaShop: Improper Control of Generation of Code
PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no