shopperlabs vulnerabilities
17 published CVEs name shopperlabs among the affected products.
- 17Published CVEs17 of them scored
- 17Last 12 monthspublished in the last year
- 1Critical9 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-62991
Shopper: customer detail IDOR exposes administrator and staff records
shopperlabs · shopper
Medium6.5 - CVE-2026-62990
Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation
shopperlabs · shopper
High8.7 - CVE-2026-62989
Shopper: missing variant-delete authorization permits destructive single and bulk actions
shopperlabs · shopper
High8.1 - CVE-2026-56828
Shopper: read-only team permissions allow administrator creation and permission escalation
shopperlabs · shopper
High8.8 - CVE-2026-114387
Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components
shopperlabs · shopper
High8.7 - CVE-2026-56826
Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration
shopperlabs · shopper
Medium5.4 - CVE-2026-56830
Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization
shopperlabs · shopper
Medium6.5 - CVE-2026-56831
Shopper: Negative discount values accepted and propagated through order calculation pipeline
shopperlabs · shopper
Medium6.5 - CVE-2026-56827
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
shopperlabs · shopper
High8.1 - CVE-2026-56829
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
shopperlabs · shopper
High8.1