1.7.8.11 is the last release of the 1.7 branch. These vulnerabilities were fixed by PrestaShop in later versions and never backported. Updating your branch to the end does not close them.
One mark per flaw — 18 out of 19 are neutralised on our side.
| Severity | Vulnerability | Fixed by PrestaShop |
Blocked by the firewall |
PrestaSecure patch |
|---|---|---|---|---|
| Critical | CVE-2026-44212 PrestaShop has a stored XSS executable in customer service view Fixed upstream in 8.2.6 | × not on your branch | ✓ confirmed | ✓ available |
| High | CVE-2026-33673 PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables Fixed upstream in 8.2.5 | × not on your branch | ✓ confirmed | ✓ available |
| High | no CVE reference Formula injection in CSV exports (CSV injection) Fixed upstream in 8.2.8 | × not on your branch | ? not assessed | ✓ available |
| High | no CVE reference Client IP address can be spoofed through the X-Forwarded-For header Fixed upstream in 8.2.8 | × not on your branch | ? not assessed | ✓ available |
| High | no CVE reference Server-Side Request Forgery through image URLs in the CSV import Fixed upstream in 8.2.8 | × not on your branch | ? not assessed | ✓ available |
| High | no CVE reference PrestaShop core — CSV formula injection dans l'export legacy (AdminController::processExport) Fixed upstream in 99.0.0 | × not on your branch | ? not assessed | ✓ available |
| High | no CVE reference PrestaShop core — jeton de réinitialisation de mot de passe prévisible (prise de compte client) | × not on your branch | ? not assessed | ✓ available |
| Medium | CVE-2023-25170 Possible CSRF token fixation Fixed upstream in 8.0.1 | × not on your branch | × out of scope | – |
| Medium | CVE-2023-39525 PrestaShop path traversal Fixed upstream in 8.1.1 | × not on your branch | ✓ confirmed | ✓ available |
| Medium | CVE-2023-39528 PrestaShop file access through path traversal Fixed upstream in 8.1.1 | × not on your branch | ✓ confirmed | ✓ available |
| Medium | CVE-2023-39529 PrestaShop file deletion via attachment API Fixed upstream in 8.1.1 | × not on your branch | ✓ confirmed | ✓ available |
| Medium | CVE-2023-39530 PrestaShop file deletion via CustomerMessage Fixed upstream in 8.1.1 | × not on your branch | ✓ confirmed | ✓ available |
| Medium | CVE-2023-43663 PrestaShop allows users to uninstall modules from backoffice, even with low rights Fixed upstream in 8.1.2 | × not on your branch | ? not assessed | ✓ available |
| Medium | CVE-2023-43664 PrestaShop allows employee without any access rights to list all installed modules Fixed upstream in 8.1.2 | × not on your branch | ? not assessed | ✓ available |
| Medium | CVE-2025-51586 Presta Shop vulnerable to email enumeration Fixed upstream in 8.2.3 | × not on your branch | ? not assessed | ✓ available |
| Medium | CVE-2026-25597 PrestaShop affected by time based enumeration in FO login form Fixed upstream in 8.2.4 | × not on your branch | ? not assessed | ✓ available |
| Medium | no CVE reference SQL injection through back-office list filters Fixed upstream in 8.2.8 | × not on your branch | ? not assessed | ✓ available |
| Medium | no CVE reference Improper access control on the back-office notifications endpoint exposes customer data Fixed upstream in 8.2.8 | × not on your branch | ? not assessed | ✓ available |
| Low | CVE-2026-33674 PrestaShop: Improper Use of Validation Framework Fixed upstream in 8.2.5 | × not on your branch | ? not assessed | ✓ available |
100 vulnerabilities found by our own team on commercial modules, across 82 different modules. None carries a public CVE reference: they exist nowhere else.
We publish neither the module name, nor the vector, nor how to exploit them. The vendor has not always shipped a fix, and the detail would expose every store running those modules — including stores that are not our customers. Our customers are protected without waiting for the flaw to become public.
Module concerned: · Vector:
Up to date with your branch, yes. In the clear, no: the flaws listed here were fixed in lines 8 and 9 and never backported to 1.7.8. Going to the end of your branch does not close them.
It is the most complete way to close them, but not the only one: our patches close some of them without a version change, and the firewall blocks the attack on others. Migrating from 1.7 is a project — theme, modules and data must follow — so it needs preparation, and you are not left unprotected in the meantime.
Because we have not audited their coverage yet. We would rather write that than display protection we have not verified. A flaw marked "confirmed" went through a real blocking test.
Considerably. The 1.7.0 to 1.7.7 branches carry around twenty additional flaws compared to 1.7.8. If you are on one of them, moving at least to 1.7.8.11 already closes a good part of the risk.
No update to your branch will fix them: they are permanent. Our patches close some of them without a version change, our firewall blocks the attack on others. Compare the three plans to see which one covers your situation.
Two-minute install. 14-day money-back, no questions asked.
Most of this catalogue comes from FriendsOfPresta and the GitHub Advisory database. We map it to the versions actually affected, we write the patches that are missing, and we test what our firewall blocks.
