Product by Shopperlabs
Shopper
14 known vulnerabilities in Shopper (Shopperlabs), 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-56828 | Shopper: read-only team permissions allow administrator creation and permission escalation | 8.8 | |
| High | CVE-2026-56827 | Shopper: Missing Authorization | 8.1 | |
| High | CVE-2026-56829 | Shopper: Missing Authorization | 8.1 | |
| High | CVE-2026-56825 | Shopper: Missing authorization on product removal actions in CollectionProducts component | 8.1 | |
| High | CVE-2026-114387 | Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components | 8.8 | |
| High | CVE-2026-47743 | Shopper: Multiple data integrity and disclosure issues in admin Livewire components | 8.7 | |
| Critical | CVE-2026-47744 | Shopper: Authorization bypass and RBAC privilege escalation in team settings | 9.9 | |
| Medium | CVE-2026-56831 | Shopper: Negative discount values accepted and propagated through order calculation pipeline | 6.5 | |
| Medium | CVE-2026-56830 | Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization | 6.5 | |
| Medium | CVE-2026-56826 | Shopping privilege escalation through missing authorization in Settings components | 5.4 | |
| High | CVE-2026-47740 | Shopper: Authorization bypass in multiple Livewire admin components | 8.1 | |
| Medium | CVE-2026-47745 | Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables | 6.5 | |
| Medium | CVE-2026-47742 | Shopper: Missing authorization on Product admin Livewire sub-form components | 6.5 | |
| Medium | CVE-2026-47741 | Shopper: Race condition on Discount.usage_limit allows silent over-redemption | 5.9 |