The 9 line is still maintained: fixes exist and ship. Everything depends on where you stand on the ladder below — a store updated to the last rung has no known unfixed core vulnerability.
| Severity | Vulnerability | Fixed by PrestaShop |
Blocked by the firewall |
PrestaSecure patch |
Closed in 9.1.4 |
|---|---|---|---|---|---|
| Critical | CVE-2026-44212 PrestaShop has a stored XSS executable in customer service view Fixed upstream in 9.1.1 | × not on your branch | ? not assessed | ✓ available | ✓ closed |
| Critical | no CVE reference Unauthenticated stored XSS in AdminCustomerThreads via Contact Us form (PS 9.x) Fixed upstream in 9.1.1 | × not on your branch | ✓ confirmed | ✓ available | ✓ closed |
| High | CVE-2026-33673 PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables Fixed upstream in 9.1.0 | × not on your branch | ✓ confirmed | ✓ available | ✓ closed |
| High | CVE-2026-33673 PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables Fixed upstream in 9.1.0 | × not on your branch | ✓ confirmed | ✓ available | ✓ closed |
| High | no CVE reference Formula injection in CSV exports (CSV injection) Fixed upstream in 9.1.5 | × not on your branch | ? not assessed | ✓ available | × still there |
| High | no CVE reference Client IP address can be spoofed through the X-Forwarded-For header Fixed upstream in 9.1.5 | × not on your branch | ? not assessed | ✓ available | × still there |
| High | no CVE reference Server-Side Request Forgery through image URLs in the CSV import Fixed upstream in 9.1.5 | × not on your branch | ? not assessed | ✓ available | × still there |
| High | no CVE reference PrestaShop core — CSV formula injection dans l'export legacy (AdminController::processExport) Fixed upstream in 99.0.0 | × not on your branch | ? not assessed | ✓ available | × still there |
| High | no CVE reference PrestaShop core — jeton de réinitialisation de mot de passe prévisible (prise de compte client) | × not on your branch | ? not assessed | ✓ available | × still there |
| Medium | no CVE reference SQL injection through back-office list filters Fixed upstream in 9.1.5 | × not on your branch | ? not assessed | ✓ available | × still there |
| Medium | no CVE reference Improper access control on the back-office notifications endpoint exposes customer data Fixed upstream in 9.1.5 | × not on your branch | ? not assessed | ✓ available | × still there |
| Low | CVE-2026-33674 PrestaShop: Improper Use of Validation Framework Fixed upstream in 9.1.0 | × not on your branch | × out of scope | ✓ available | ✓ closed |
100 vulnerabilities found by our own team on commercial modules, across 82 different modules. None carries a public CVE reference: they exist nowhere else.
We publish neither the module name, nor the vector, nor how to exploit them. The vendor has not always shipped a fix, and the detail would expose every store running those modules — including stores that are not our customers. Our customers are protected without waiting for the flaw to become public.
Module concerned: · Vector:
Free of known unfixed core flaws, yes, as of the date shown at the bottom of the page. It does not mean a 9.1 store is invulnerable: third-party modules, weak passwords and files dropped during an earlier intrusion remain entry points, independent of the core version.
Flaws rated critical remain open on 9.0. Moving to 9.1 is a minor update with no major architectural change: the ratio between effort and risk avoided clearly favours it.
It is the logical medium-term target, but migrating from 1.7 is a project, not an update. In the meantime, moving to the latest release of your current line already closes a good part of the flaws.
Every coverage marked "confirmed" was validated by a blocking test on the corresponding attack request, and carries an audit date. Flaws whose coverage has not been tested are marked "not assessed", not "protected".
Move to the latest release of your line: it is free and it closes the core flaws. However, no PrestaShop update will fix the ones in your modules — that is where we come in.
Two-minute install. 14-day money-back, no questions asked.
Most of this catalogue comes from FriendsOfPresta and the GitHub Advisory database. We map it to the versions actually affected, we write the patches that are missing, and we test what our firewall blocks.
