What’s Vulnerable › Vulnerabilities

CVE-2022-31101: SQL Injection in prestashop/blockwishlist

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 23.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-27 · updated 2026-06-17
• Weakness: CWE-89

Description

prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

• PrestaShop blockwishlist: before 2.1.1 — fixed in 2.1.1

How to fix

Upgrade to a fixed version: PrestaShop blockwishlist 2.1.1. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html
• https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084
• https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp
• http://packetstormsecurity.com/files/168003/Prestashop-Blockwishlist-2.1.0-SQL-Injection.html
• https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084
• https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp

Get alerted when CVE-2022-31101 or the next vulnerability affects your stack