What’s Vulnerable › Products

shopperlabs shopper vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your shopperlabs shopper version is affected

Latest shopperlabs shopper vulnerabilities

• CVE-2026-62991 — Shopper: customer detail IDOR exposes administrator and staff records (CVSS 6.5)
• CVE-2026-62990 — Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation (CVSS 8.7)
• CVE-2026-62989 — Shopper: missing variant-delete authorization permits destructive single and bulk actions (CVSS 8.1)
• CVE-2026-56828 — Shopper: read-only team permissions allow administrator creation and permission escalation (CVSS 8.8)
• CVE-2026-114387 — Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components (CVSS 8.8)
• CVE-2026-56826 — Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration (CVSS 5.4)
• CVE-2026-56831 — Shopper: Negative discount values accepted and propagated through order calculation pipeline (CVSS 6.5)
• CVE-2026-56830 — Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization (CVSS 6.5)
• CVE-2026-56829 — Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component (CVSS 8.1)
• CVE-2026-56827 — Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers (CVSS 8.1)
• CVE-2026-56825 — Shopper: Missing authorization on product removal actions in CollectionProducts component (CVSS 8.1)
• CVE-2026-47743 — Shopper: Multiple data integrity and disclosure issues in admin Livewire components (CVSS 8.7)
• CVE-2026-47745 — Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables (CVSS 6.5)
• CVE-2026-47744 — Shopper: Authorization bypass and RBAC privilege escalation in team settings (CVSS 9.9)
• CVE-2026-47742 — Shopper: Missing authorization on Product admin Livewire sub-form components (CVSS 6.5)
• CVE-2026-47741 — Shopper: Race condition on Discount.usage_limit allows silent over-redemption (CVSS 5.9)
• CVE-2026-47740 — Shopper: Authorization bypass in multiple Livewire admin components (CVSS 8.1)