Skip to content
OpenAdvisories

Vendor

PrestaShop

78 known vulnerabilities.

Products

PrestaShop 58 productcomments 3 blockwishlist 2 M4 PDF plugin 2 ps_facetedsearch 2 ps_linklist 2 blockreassurance 2 ps_socialfollow 1 The firmware 1 psgdpr 1 contactform 1 dashproducts 1 ps_contactinfo 1 ps_emailsubscription 1
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 7.7
    CVE-2026-33673

    PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables

    PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-office access …

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • High 8.1
    CVE-2024-21627

    Some attribute not escaped in Validate::isCleanHTML method

    PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3…

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • High 8.3
    CVE-2023-39527

    PrestaShop XSS vulnerability through Validate::isCleanHTML method

    PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCleanHTML` method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • High 8.6
    CVE-2023-30838

    PrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML method

    PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) injection, allowed by the presence of pr…

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • High 7.7
    CVE-2023-30545

    PrestaShop arbitrary file read vulnerability

    PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function …

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • High 8.1
    CVE-2022-31101 Public exploit Scanner template EPSS 23%

    SQL Injection in prestashop/blockwishlist

    prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are …

    PrestaShop blockwishlist prestashop/blockwishlist Packagist
  • High 7.5
    CVE-2021-43789 Public exploit

    Blind SQLi using Search filters in PrestaShop

    PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2.

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • High 8.7
    CVE-2020-26225

    Reflected XSS in PrestaShop Product Comments

    In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2.0

    PrestaShop productcomments prestashop/productcomments Packagist
  • High 7.5
    CVE-2020-26224

    Improper Access Control in PrestaShop

    In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.

    PrestaShop PrestaShop Web / CMS
  • High 8.0
    CVE-2020-15178

    Potential XSS in PrestaShop contactform

    In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The `message` field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript i…

    PrestaShop contactform prestashop/contactform Packagist
  • High 8.9
    CVE-2020-4074

    Improper Authentication

    In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6.

    PrestaShop PrestaShop Web / CMS
  • High 7.1
    CVE-2020-15082

    External control of configuration setting in the dashboard in PrestaShop

    In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fixed in 1.7.6.6

    PrestaShop PrestaShop Web / CMS
  • High 7.6
    CVE-2020-5250 Public exploit

    Possible information disclosure in PrestaShop

    In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all inform…

    PrestaShop PrestaShop Web / CMS