PrestaShop has 7 CVEs on record between 2025 and 2026. 3 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 4.3 (medium), with 2 rated critical. None have a confirmed exploitation report. Most affected products: prestashop_checkout (3), PrestaShop (1), blockwishlist (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 1
Products
- prestashop_checkout 3
- PrestaShop 1
- blockwishlist 1
- prestashop/ps_facetedsearch 1
- psgdpr 1
Worst active — by depth score
CVE-2025-61922Critical· 9.1PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal62CVE-2026-54159Critical· 10.0prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE55CVE-2026-84186Medium· 6.9Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse pro…38CVE-2026-92810Medium· 4.3PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier36CVE-2026-92809Medium· 4.3PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer36
PrestaShop vulnerabilities
CVEs affecting PrestaShop, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-92809Medium· 4.3PoCPrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for …
CVE-2026-92810Medium· 4.3PoCPrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential…
CVE-2026-84186Medium· 6.9Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse pro…
Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse pro…
CVE-2026-54159Critical· 10.0prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
CVE-2025-61924Low· 3.8PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP array_search(). Th…
CVE-2025-61923Medium· 4.1PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosur…
CVE-2025-61922Critical· 9.1PoCPrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling a…