Skip to content
OpenAdvisories

Vendor

PrestaShop

80 known vulnerabilities.

Products

PrestaShop 60 productcomments 3 blockwishlist 2 M4 PDF plugin 2 ps_facetedsearch 2 ps_linklist 2 blockreassurance 2 ps_socialfollow 1 The firmware 1 psgdpr 1 contactform 1 dashproducts 1 ps_contactinfo 1 ps_emailsubscription 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-54159

    ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

    PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL w…

    PrestaShop ps_facetedsearch prestashop/ps_facetedsearch Packagist
  • Critical 9.3
    CVE-2026-44212 Public exploit

    PrestaShop: Stored XSS executable in customer service view

    PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us for…

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • Critical 9.7
    CVE-2024-34716 Public exploit EPSS 59%

    PrestaShop vulnerable to XSS via customer contact form in FO, through file upload

    PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the custo…

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • Critical 9.1
    CVE-2023-47110

    Any value can be changed in the configuration table by an employee having access to block reassurance module

    blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in module blockreassurance allows modifying any value in the configuration table. This vulnerability has b…

    PrestaShop blockreassurance prestashop/blockreassurance Packagist
  • Critical 9.1
    CVE-2023-39526 Public exploit

    PrestaShopSQL manager vulnerability (potential RCE)

    PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patc…

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • Critical 10.0
    CVE-2023-30839 Public exploit

    PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager"

    PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 cont…

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • Critical 9.8
    CVE-2022-31181 Public exploit Scanner template

    Remote code execution in prestashop

    PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7.…

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • Critical 9.0
    CVE-2022-21686

    Server Side Twig Template Injection in PrestaShop

    PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no…

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist