VulnSea

shopperlabs has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 5. The median CVSS is 8.1 (high). None have a confirmed exploitation report. The most common weakness class is CWE-862 (6).

CVEs per month

Last 12 months, by publish date

111201020304050607080910
Exploited share
0% vs 1% corpus
Median CVSS
8.1
Publish → KEV
—
Last 90 days
7 prev 0

Products

  • shopper 7
Follow shopperlabs:RSS feedSave a search →Embed badge ↗
7
Total CVEs
0
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

shopperlabs vulnerabilities

CVEs affecting shopperlabs, newest first. Open any entry for full detail, references, and exploit status.

7 CVEsRSS

CVE-2026-56828High· 8.8
3d ago

Shopper: read-only team permissions allow administrator creation and permission escalation

Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_…

▾ Twilightshopperlabs · shoppervia CVEORG
CVE-2026-114387High· 8.8
1w ago

Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Pe…

▾ Twilightshopperlabs · shopperEPSS 0.32%via CVEORG
CVE-2026-56831Medium· 6.5PoC
1mo ago

Shopper is a Headless e-commerce Admin Panel

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Di…

▾ Twilightshopperlabs · shopperEPSS 0.43%via NVD
CVE-2026-56830Medium· 6.5
1mo ago

Shopper is a Headless e-commerce Admin Panel

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used …

▾ Sunlitshopperlabs · shopperEPSS 0.39%via NVD
CVE-2026-56829High· 8.1PoC
1mo ago

Shopper is a Headless e-commerce Admin Panel

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable be…

▾ Midnightshopperlabs · shopperEPSS 0.50%via NVD
CVE-2026-56827High· 8.1PoC
1mo ago

Shopper is a Headless e-commerce Admin Panel

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.ph…

▾ Midnightshopperlabs · shopperEPSS 0.50%via NVD
CVE-2026-56825High· 8.1PoC
1mo ago

Shopper is a Headless e-commerce Admin Panel

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, …

▾ Midnightshopperlabs · shopperEPSS 0.50%via NVD
shopperlabs vulnerabilities (CVEs) · VulnSea