shopperlabs vulnerabilities

Newest CVEs

• CVE-2026-62991

  Shopper: customer detail IDOR exposes administrator and staff records

  shopperlabs · shopper

  Medium6.5
• CVE-2026-62990

  Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation

  shopperlabs · shopper

  High8.7
• CVE-2026-62989

  Shopper: missing variant-delete authorization permits destructive single and bulk actions

  shopperlabs · shopper

  High8.1
• CVE-2026-56828

  Shopper: read-only team permissions allow administrator creation and permission escalation

  shopperlabs · shopper

  High8.8
• CVE-2026-114387

  Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components

  shopperlabs · shopper

  High8.7
• CVE-2026-56826

  Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration

  shopperlabs · shopper

  Medium5.4
• CVE-2026-56830

  Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

  shopperlabs · shopper

  Medium6.5
• CVE-2026-56831

  Shopper: Negative discount values accepted and propagated through order calculation pipeline

  shopperlabs · shopper

  Medium6.5
• CVE-2026-56827

  Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

  shopperlabs · shopper

  High8.1
• CVE-2026-56829

  Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

  shopperlabs · shopper

  High8.1