Prestashop vulnerabilities
78 CVEs and advisories name Prestashop as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-124916PrestaShop Performance Debug Configuration PHP Code Injection
- CVE-2026-92810PrestaShop blockwishlist through 3.0.2 Information Disclosure
- CVE-2026-92809PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
- CVE-2026-84186Incorrect access control in PrestaShop
- CVE-2026-54159ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
- CVE-2026-14846Incorrect neutralisation in the PrestaShop firmware
- CVE-2026-44212PrestaShop: Stored XSS executable in customer service view
- CVE-2026-33674PrestaShop: Improper Use of Validation Framework
- CVE-2026-33673PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
- CVE-2026-25597PrestaShop has a time based enumeration in FO login form
- CVE-2025-1230Cross-Site Scripting (XSS) vulnerability in Prestashop
- CVE-2025-24027ps_contactinfo has potential XSS due to usage of the nofilter tag in template
- CVE-2024-34717Anonymous PrestaShop customer can download other customers' invoices
- CVE-2024-34716PrestaShop vulnerable to XSS via customer contact form in FO, through file upload
- CVE-2024-26129Prestashop vulnerable to path disclosure in JavaScript variable
- CVE-2024-21628XSS can be stored in DB from "add a message form" in order detail page (FO)
- CVE-2024-21627Some attribute not escaped in Validate::isCleanHTML method
- CVE-2023-47110Any value can be changed in the configuration table by an employee having access to block reassurance module
- CVE-2023-47109PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block
- CVE-2023-43664Employee without any access rights can list all installed modules in Prestashop
- CVE-2023-43663Improper Privilege Management in Prestashop
- CVE-2022-45448Cross-site Scripting in M4 PDF plugin for Prestashop sites
- CVE-2022-45447Path Traversal in M4 PDF plugin for Prestashop sites
- CVE-2023-39530PrestaShop vulnerable to file deletion via CustomerMessage
- CVE-2023-39529PrestaShop vulnerable to file deletion via attachment API
- CVE-2023-39528PrestaShop vulnerable to file reading through path traversal
- CVE-2023-39527PrestaShop XSS vulnerability through Validate::isCleanHTML method
- CVE-2023-39526PrestaShopSQL manager vulnerability (potential RCE)
- CVE-2023-39525PrestaShop vulnerable to path traversal
- CVE-2023-39524PrestaShop vulnerable to boolean SQL injection in search product in BO