# Vulnerable PrestaShop modules: known CVEs and fixed versions

> List of vulnerable PrestaShop modules: CVEs, affected and fixed versions, core security advisories and a step-by-step security audit of your own store.

URL: https://webintacta.com/en/guides/vulnerable-prestashop-modules
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** Most hacked PrestaShop stores are broken into through third-party modules with published vulnerabilities (CVEs), not through the core. This guide lists well-known modules with flaws documented by Friends of Presta, with the affected and fixed versions, and explains how to check the ones in your store. If one of your modules is on the list and you have not updated it, update or remove it and check whether it has already been used to get in.


By Jose Soriano (WebIntacta) · published 2026-10-24

Most of the hacked PrestaShop stores I look at were not compromised through the core, but through a third-party module with a flaw that had been public for months. This is a selection of well-known or widely installed modules with documented vulnerabilities, taken only from verifiable sources. Last reviewed: October 8, 2026.

## How to read this list

Each row gives the module's **technical name** (the name of its folder in `modules/`, which is what you should look for), its commercial name, the CVE identifier linked to the advisory, the affected versions, the version that fixes it and the published severity (CVSS 3.1 score, 0 to 10). I flag the cases where the advisory says the flaw **has been used in real attacks**, mostly to install skimmers that steal credit cards.

The main source is the advisory database of [Friends of Presta](https://security.friendsofpresta.org/), the non-profit association that coordinates security for the PrestaShop ecosystem, cross-checked with each CVE's record in the [NVD](https://nvd.nist.gov/). It is not a complete list: Friends of Presta publishes hundreds of advisories, and here I collect the ones for payment, checkout, blog, cookie and theme modules that I run into most often in the stores I check.

> If your module is not here, that does not mean it is safe. And if it is here, that does not mean your store is hacked: it means that if you have an affected version, you should update or remove the module now.

## Modules with published flaws

### Payment and checkout

| Module | CVE | Affected | Fixed in | Severity |
| --- | --- | --- | --- | --- |
| `blockwishlist` Wishlist (PrestaShop) | [CVE-2022-31101](https://security.friendsofpresta.org/modules/2022/06/24/blockwishlist.html) | 2.0.0 to 2.1.0 | 2.1.1 | High (8.8) |
| `ps_checkout` PrestaShop Checkout (PrestaShop) | [CVE-2025-61922](https://security.friendsofpresta.org/modules/2025/10/23/ps_checkout.html) | from 1.3.0 | 4.4.1 / 5.0.5 | Critical (9.1) |
| `paypal` PayPal Official (202 ecommerce) | [CVE-2024-41670](https://security.friendsofpresta.org/modules/2024/07/26/paypal.html) | ≤ 6.4.1 (PS 1.7+) · ≤ 3.18.0 (PS 1.6) | 6.4.2 / 3.18.1 | Medium (6.5) |
| `paypal` PayPal for PrestaShop 1.6 and 1.5 (202 ecommerce) | [CVE-2023-28843](https://security.friendsofpresta.org/modules/2023/03/31/paypal-CVE-2023-28843.html) | 3.12.0 to 3.16.3 | 3.16.4 | Critical (9.8) |
| `stripejs` Stripe Payment Pro (NTS), not stripe_official | [CVE-2023-23315](https://security.friendsofpresta.org/modules/2023/03/01/stripejs.html) | < 4.5.5 | 4.5.5 | Critical (9.8) · **used in attacks** |
| `MoneticoPaiement` Monetico Paiement (EuroInformation) | [CVE-2023-45256](https://security.friendsofpresta.org/modules/2025/06/10/MoneticoPaiement.html) | ≤ 1.1.0 | 1.1.1 | Critical (9.8) |
| `supercheckout` One Page Checkout, Social Login & Mailchimp (KnowBand) | [CVE-2023-45384](https://security.friendsofpresta.org/modules/2023/10/17/supercheckout.html) | ≤ 6.0.6 | 6.0.7 | Critical (10) · **used in attacks** |
| `supercheckout` One Page Checkout, Social Login & Mailchimp (KnowBand) | [CVE-2023-44024](https://security.friendsofpresta.org/modules/2023/10/05/supercheckout.html) | ≤ 8.0.3 | 8.0.4 | Critical (9.8) · **used in attacks** |
| `pscartabandonmentpro` Abandoned Cart Reminder Pro (PrestaShop) | [CVE-2024-28392](https://security.friendsofpresta.org/modules/2024/03/14/pscartabandonmentpro.html) | ≤ 2.0.11 | 2.0.12 | High (8.8) |
| `simpleimportproduct` Product Catalog (CSV, Excel) Import (MyPrestaModules) | [CVE-2024-25846](https://security.friendsofpresta.org/modules/2024/02/27/simpleimportproduct.html) | ≤ 6.7.0 | 6.7.1 (FoP advises considering removing it) | Critical (10) · **used in attacks** |
| `autosuggest` Search Auto Suggest (KnowBand) | [CVE-2024-33272](https://security.friendsofpresta.org/modules/2024/04/25/autosuggest.html) | < 2.0.0 | 2.0.0 | Critical (9.8) · **used in attacks** |

### Popups, cookies and page builders

| Module | CVE | Affected | Fixed in | Severity |
| --- | --- | --- | --- | --- |
| `advancedpopupcreator` Advanced Popup Creator (Idnovate) | [CVE-2025-69633](https://security.friendsofpresta.org/modules/2026/02/16/advancedpopupcreator-cve-2025-69633.html) | < 1.2.7 | 1.2.7 | Critical (9.8) · **used in attacks** |
| `creativepopup` Creative Popup (WebshopWorks) | [CVE-2023-45381](https://security.friendsofpresta.org/modules/2023/10/19/creativepopup.html) | ≤ 1.6.9 | 1.6.10 | Critical (9.8) |
| `lgcookieslaw` EU Cookie Law GDPR, Banner + Blocker (Línea Gráfica) | [CVE-2022-44727](https://security.friendsofpresta.org/modules/2022/11/06/lgcookieslaw.html) | 1.5.0 to < 2.1.3 | 2.1.3 | Critical (9.8) |
| `cookiebanner` Cookie Law, Banner + Cookie blocker (UpLight) | [CVE-2023-39640](https://security.friendsofpresta.org/modules/2023/09/21/cookiebanner.html) | ≤ 1.5.0 | 1.5.1 | Critical (9.8) |
| `appagebuilder` Ap Page Builder (Apollotheme / LeoTheme) | [CVE-2022-22897](https://security.friendsofpresta.org/modules/2023/01/05/appagebuilder.html) | ≤ 2.4.5 | see advisory; today, 4.0.0 or later | Critical (9.8) |
| `appagebuilder` Ap Page Builder (Apollotheme / LeoTheme) | [CVE-2024-6648](https://security.friendsofpresta.org/modules/2025/05/22/appagebuilder.html) | < 4.0.0 | 4.0.0 | High (8.7) |

### Blogs, menus and themes

| Module | CVE | Affected | Fixed in | Severity |
| --- | --- | --- | --- | --- |
| `leoblog` Leo Blog (LeoTheme) | [CVE-2023-39639](https://security.friendsofpresta.org/modules/2023/08/31/leoblog.html) | ≤ 3.1.2 | 3.1.3 | Critical (9.8) · **used in attacks** |
| `jmsmegamenu` Jms MegaMenu (Joommasters) | [CVE-2023-29630](https://security.friendsofpresta.org/modules/2023/03/13/jmsmegamenu.html) | all (at least 1.1.x and 2.0.x) | no fixed version published | Critical (9.8) · **used in attacks** |
| `tvcmsblog` Electron theme blog (Themevolty) | [CVE-2023-27846](https://security.friendsofpresta.org/modules/2023/10/25/tvcmsblog.html) | < 4.0.8 | 4.0.8 | Critical (9.8) |
| `smartblog` SmartBlog (SmartDataSoft) | [CVE-2021-37538](https://security.friendsofpresta.org/module/2021/08/24/smartblog.html) | < 4.0.6 | 4.0.6 | Critical (9.8) |
| `ph_simpleblog` Prestahome blog | [CVE-2021-36748](https://security.friendsofpresta.org/module/2021/08/20/ph_simpleblog.html) | < 1.7.8 | 1.7.8 | Critical (9.8) · **used in attacks** |
| `prestablog` PrestaBlog (HDclic) | [CVE-2023-45378](https://security.friendsofpresta.org/modules/2023/10/26/prestablog.html) | ≤ 4.4.7 | 4.4.8 | Critical (9.8) |

### Quotes, shipping and native modules

| Module | CVE | Affected | Fixed in | Severity |
| --- | --- | --- | --- | --- |
| `opartdevis` Opart Devis (Opart) | [CVE-2023-48188](https://security.friendsofpresta.org/modules/2023/11/23/opartdevis.html) | 4.5.18 to 4.6.12 | 4.6.13 | Critical (9.8) |
| `correosoficial` Correos Oficial (Grupo Correos, the Spanish postal service) | [CVE-2022-46639](https://security.friendsofpresta.org/modules/2023/01/23/correosoficial.html) | 1.1.0 to < 1.2.0 | 1.2.0 | High (7.5) |
| `ps_contactinfo` Contact information (native module) | [CVE-2025-24027](https://security.friendsofpresta.org/core/2025/01/22/ps_contactinfo.html) | ≤ 3.3.2 | 3.3.3 | Low (4.1) |

Source: the Friends of Presta advisories linked from each CVE, cross-checked with the NVD. Reviewed October 8, 2026.

Two advisories carry a special note: for `simpleimportproduct`, Friends of Presta considers that the fix still leaves a high risk and recommends considering removing the module; and for `jmsmegamenu` no fixed version has been published, so the only safe way out is to remove or replace it.

## PrestaShop core

The core has flaws too, although they are fixed and disclosed in an orderly way in the [security advisories of the official repository](https://github.com/PrestaShop/PrestaShop/security/advisories). The most relevant ones when deciding whether to upgrade:

- **[CVE-2022-31181](https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hrgx-p36p-89q4)** · from 1.6.0.10 · fixed in 1.7.8.7 · Critical (9.8). SQL injection chained with the Smarty cache stored in MySQL to execute code; this is the 2022 campaign that left a `blm.php` in the root folder and a fake payment form. It is sometimes cited as CVE-2022-36408, an identifier rejected as a duplicate.
- **[CVE-2023-30839](https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-p379-cxqh-q822)** · fixed in 8.0.4 and 1.7.8.9 · Critical. A back-office employee could write to the database through the SQL manager without having permission to do so.
- **[CVE-2023-39528](https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hpf4-v7v2-95p2)** and **[CVE-2023-39526](https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc)** · fixed in 8.1.1 (and the second one also in 8.0.5 and 1.7.8.10) · Critical. Reading server files and possible code execution from the back office.
- **[CVE-2024-34716](https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78)** · 8.1.0 to 8.1.5 · fixed in 8.1.6 · Critical. XSS through the contact form with an attached file.
- **[CVE-2026-44212](https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-w9f3-qc75-qgx9)** · fixed in 8.2.6 and 9.1.1 · Critical. Stored XSS that runs in the back-office customer service view.
- **August 2026**: five advisories (SQL injection in back-office filters, SSRF in CSV import, IP spoofing with `X-Forwarded-For`, customer data exposure in notifications and formula injection in CSV exports), fixed in **8.2.8 and 9.1.5**.

**Official modules.** Not everything comes from third parties: in June 2026 a critical flaw (10 out of 10) was published in **ps_facetedsearch**, the official catalog filter module that ships with almost every 1.7, 8 and 9 store. It affects 3.0.0 to 4.0.3 and is fixed in 4.0.4. How to check your version and what to do if you cannot update: [ps_facetedsearch (CVE-2026-54159)](https://webintacta.com/en/guides/ps-facetedsearch-vulnerability).

If you are on 1.7, none of the flaws discovered from now on will get a patch: the branch stopped being maintained when PrestaShop 9.0 came out. How to make the jump: [upgrade PrestaShop](https://webintacta.com/en/guides/upgrade-prestashop).

## How to check your store

### 1. Get the list of modules and versions

In the back office, **Modules → Module Manager** shows each module with its version. Faster, from the database (replace `ps_` with your prefix):

```
SELECT name, version, active FROM ps_module ORDER BY name;
```

Careful: this table stores the version **registered at install time**. If someone uploaded new files over FTP without going through the module manager, the real version is in the module's main file (`modules/name/name.php`, on the `$this->version` line).

### 2. Look for the ones that do not show up

A module that was uninstalled but whose files are still in `modules/` does not appear in the module manager and **can still be attacked**, because its scripts respond just the same. Compare the list of folders with the one in the database:

```
ls modules/ > folders.txt
# compare with the name column of ps_module: anything only in folders.txt needs checking
```

### 3. Cross-check with the advisories

Search for each technical name on [security.friendsofpresta.org](https://security.friendsofpresta.org/) and in the NVD. If you have an affected version: update to the fixed one, and if there is no fix or the author no longer supports it, remove the module and its files.

### 4. If a module was affected, check whether someone already got in

Updating closes the door, but it does not throw out whoever is already inside. If you had a vulnerable version with an exploitation warning, check the store as if it were hacked: modified files, overrides, configuration and checkout. The steps are in [what to do if your PrestaShop is hacked](https://webintacta.com/en/guides/prestashop-hacked-what-to-do).

The [read-only connector](https://webintacta.com/en/read-only-connector) does this cross-check automatically: it reads the real list of modules and versions from inside the store, compares it with the published advisories and checks core integrity, without being able to change anything. From the outside, the [free scan](https://webintacta.com/en/free-website-security-scan) detects the modules that are publicly visible. If you want someone to do it for you, the [PrestaShop security audit](https://webintacta.com/en/prestashop-security) checks every module, inactive ones included, at a fixed price; if a module has already been exploited, go straight to [hacked PrestaShop repair](https://webintacta.com/en/hacked-prestashop-repair).

## If the author does not fix the flaw

It happens more than you would think: abandoned modules, authors who do not reply, or themes bought years ago from a vendor that no longer exists. In those cases there are three real options, in order of preference:

1. **Replace the module** with a maintained one that does the same job, or with a native PrestaShop module if it covers the feature.
2. **Remove it** if the feature is not essential. Delete the whole folder from `modules/`; uninstalling is not enough.
3. **Fix it yourself or have your developer fix it**, if you have the code: Friends of Presta advisories usually explain which method or parameter is vulnerable, and sometimes include the patch. It is your own fix, and you will have to maintain it with every update.

A web application firewall (WAF) can stop some of the attacks while you decide, but several advisories warn that there are variants of the attack designed to get around it. Use it as a stopgap, not as the solution.

## Sources

- [Friends of Presta: security advisories](https://security.friendsofpresta.org/) (each row links to its advisory).
- [NVD, National Vulnerability Database](https://nvd.nist.gov/) from NIST, for the description and score of each CVE.
- [PrestaShop core security advisories on GitHub](https://github.com/PrestaShop/PrestaShop/security/advisories).
- [PrestaShop's notice about the July 2022 campaign](https://build.prestashop-project.org/news/2022/major-security-vulnerability-on-prestashop-websites/).

## Frequently asked questions

### How do I know if a PrestaShop module is vulnerable?

Search for its technical name (the folder name in modules/) on security.friendsofpresta.org and in the NVD, and compare your version with the affected ones. Remember to also check uninstalled modules whose files are still on the server.

### Is it enough to disable a vulnerable module?

No. A disabled or uninstalled module still has its files on the server, and many attacks call those files directly. You need to update it or delete its folder.

### What is Friends of Presta?

A non-profit association that supports the PrestaShop ecosystem and publishes security advisories for modules, with their CVE and affected and fixed versions.

### How often is this list updated?

I review it periodically, and the date of the last review is at the top. For the latest information, always check the source directly.

## About the author

[Jose Soriano](https://webintacta.com/en/about): Full-stack developer specialized in PrestaShop, WordPress and WooCommerce, who has passed the official PrestaShop course and exam. He has been building online stores and modules since 2023 and is the founder of WebIntacta, the website security service through which he scans, cleans and maintains small-business websites and online stores himself, remotely from Ibi (Alicante, Spain). WebIntacta facts: https://webintacta.com/en/about#datos