1.7.8.11 is the last release of the 1.7 branch. These vulnerabilities were fixed by PrestaShop in later versions and never backported. Updating your branch to the end does not close them.
One mark per flaw — 18 out of 20 are neutralised on our side.
| Severity | Vulnerability | Fixed by PrestaShop |
Blocked by the firewall |
PrestaSecure patch |
|---|---|---|---|---|
| Critical | CVE-2026-44212 Unauthenticated stored XSS in AdminCustomerThreads via Contact Us form (PS 1.7 / 8.x) Fixed upstream in 8.2.6 | × not on your branch | ✓ confirmed | ✓ available |
| High | CVE-2026-33673 PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables Fixed upstream in 8.2.5 | × not on your branch | ✓ confirmed | – |
| High | no CVE reference CSV Formula Injection in exports (GHSA-w6j9-q9rq-wrqg) Fixed upstream in 8.2.8 | × not on your branch | ? not assessed | ✓ available |
| High | no CVE reference X-Forwarded-For IP spoofing (GHSA-2cr4-vw9p-pjvf) Fixed upstream in 8.2.8 | × not on your branch | ? not assessed | ✓ available |
| High | no CVE reference PrestaShop core — SSRF via import image URL (copyImg -> Tools::copy) Fixed upstream in 8.2.8 | × not on your branch | ? not assessed | ✓ available |
| High | no CVE reference PrestaShop core — CSV formula injection dans l'export legacy (AdminController::processExport) Fixed upstream in 99.0.0 | × not on your branch | ? not assessed | ✓ available |
| Medium | CVE-2023-25170 Possible CSRF token fixation Fixed upstream in 8.0.1 | × not on your branch | × out of scope | – |
| Medium | CVE-2023-39524 PrestaShop boolean SQL injection Fixed upstream in 8.1.0 | × not on your branch | ✓ confirmed | – |
| Medium | CVE-2023-39525 PrestaShop path traversal Fixed upstream in 8.1.0 | × not on your branch | ✓ confirmed | – |
| Medium | CVE-2023-39528 PrestaShop file access through path traversal Fixed upstream in 8.1.0 | × not on your branch | ✓ confirmed | – |
| Medium | CVE-2023-39529 PrestaShop file deletion via attachment API Fixed upstream in 8.1.0 | × not on your branch | ✓ confirmed | – |
| Medium | CVE-2023-39530 PrestaShop file deletion via CustomerMessage Fixed upstream in 8.1.0 | × not on your branch | ✓ confirmed | – |
| Medium | CVE-2023-43663 PrestaShop allows users to uninstall modules from backoffice, even with low rights Fixed upstream in 8.1.2 | × not on your branch | ? not assessed | ✓ available |
| Medium | CVE-2023-43664 PrestaShop allows employee without any access rights to list all installed modules Fixed upstream in 8.1.2 | × not on your branch | ? not assessed | ✓ available |
| Medium | CVE-2024-21628 PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO) Fixed upstream in 8.1.3 | × not on your branch | ✓ confirmed | – |
| Medium | CVE-2025-51586 Presta Shop vulnerable to email enumeration Fixed upstream in 8.2.3 | × not on your branch | ? not assessed | ✓ available |
| Medium | CVE-2026-25597 PrestaShop affected by time based enumeration in FO login form Fixed upstream in 8.2.4 | × not on your branch | ? not assessed | ✓ available |
| Medium | no CVE reference SQL injection via BO list filters (GHSA-whxq-pxj5-qq7v) Fixed upstream in 8.2.8 | × not on your branch | ? not assessed | ✓ available |
| Medium | no CVE reference BO notifications improper access control (GHSA-jf3w-9rmr-5rcr) Fixed upstream in 8.2.8 | × not on your branch | ? not assessed | ✓ available |
| Low | CVE-2026-33674 PrestaShop: Improper Use of Validation Framework Fixed upstream in 8.2.5 | × not on your branch | ? not assessed | – |
48 vulnerabilities found by our own team on commercial modules, across 41 different modules. None carries a public CVE reference: they exist nowhere else.
We publish neither the module name, nor the vector, nor how to exploit them. The vendor has not always shipped a fix, and the detail would expose every store running those modules — including stores that are not our customers. Our customers are protected without waiting for the flaw to become public.
Module concerned: · Vector:
Up to date with your branch, yes. In the clear, no: the flaws listed here were fixed in lines 8 and 9 and never backported to 1.7.8. Going to the end of your branch does not close them.
It is the most complete way to close them, but not the only one: our patches close some of them without a version change, and the firewall blocks the attack on others. Migrating from 1.7 is a project — theme, modules and data must follow — so it needs preparation, and you are not left unprotected in the meantime.
Because we have not audited their coverage yet. We would rather write that than display protection we have not verified. A flaw marked "confirmed" went through a real blocking test.
Considerably. The 1.7.0 to 1.7.7 branches carry around twenty additional flaws compared to 1.7.8. If you are on one of them, moving at least to 1.7.8.11 already closes a good part of the risk.
No update to your branch will fix them: they are permanent. Our patches close some of them without a version change, our firewall blocks the attack on others. Compare the three plans to see which one covers your situation.
Two-minute install. 14-day money-back, no questions asked.
Most of this catalogue comes from FriendsOfPresta and the GitHub Advisory database. We map it to the versions actually affected, we write the patches that are missing, and we test what our firewall blocks.
