PrestaShop modules with known security issues: what 2,066 stores show

In our study of PrestaShop versions in France we checked 2,066 stores. The same check also lists the modules each home page loads. We matched those modules with the security advisories that Friends of Presta publishes for PrestaShop modules, and with PrestaShop's own advisories for the core.

In short: 77% of the stores show at least one module that has had a published security advisory. That sounds worse than it is. Where the module's version is public, two in three already run the fixed version. The ones that do not are mostly on PrestaShop 1.6 and 1.7.

Most stores have a module with a past advisory#

A store with such a module usually has two of them. That is no surprise: the advisories cover the modules most stores use, like payment, shipping, newsletter and blog modules. Two in three of these advisories are SQL injections, and three in four are rated critical.

An advisory is about certain versions of a module. It says nothing about the version a store runs today. So the first row is a list of what is worth checking, not a list of holes.

Where the version shows, most are already fixed#

A store's home page rarely shows which version of a module it runs. The check reads it from the module's public config.xml file, and that file is open for only 9% of the 27,418 modules we saw. For 302 modules with an advisory, the version was public:

So most owners do update their modules. But almost one in three of those we could see did not, and an outdated module is usually not alone in the store.

Old PrestaShop versions stand out. 16% of PrestaShop 1.6 stores and 6% of 1.7 stores show at least one module that is provably older than its fix. On PrestaShop 8 and 9 it is three stores in total. These are minimums: for nine modules in ten the version is not public, so they could not be counted either way.

The modules you see most often#

The most common ones look reassuring. All 69 Chronopost modules and all 33 Brevo modules whose version we could see run the fixed version. The wishlist module comes with PrestaShop itself, and its advisory is from 2022.

The ones that are often behind are less common:

• AP Page Builder (appagebuilder): 17 of the 18 public versions are older than 4.0.0, the version that an advisory from 2025 names as fixed. A page builder holds the home page content, so it is the module owners least like to touch.
• SimpleBlog (ph_simpleblog): 13 of 32 are older than 1.7.8, the fix for an advisory from 2021.
• PayPal: 11 of 12 public versions are older than 3.16.4. The 2023 advisory concerns the PayPal module for PrestaShop 1.5 and 1.6.
• Advanced Popup Creator: all 7 public versions are older than 1.2.7, which fixed an advisory from February 2026.

No fix at all: 33 stores show a module whose author never published a fixed version. The most common are Referral and Affiliation Program (referralbyphone, 15 stores), and two modules by Posthemes: posrotatorimg and possearchproducts (7 stores each). For these the only way out is to replace or remove the module.

The core: 1.7 and 1.6 no longer get fixes#

The modules are only part of it. PrestaShop has published 5 security issues in the core since February 2024 that it fixed only in PrestaShop 8 or 9. The most serious, from May 2026, is a critical stored XSS in the customer service view. PrestaShop 1.7 had its last release in January 2024, so these stay open on every 1.7 and 1.6 store: 1,065 stores, 52% of the ones we checked.

PrestaShop 8 and 9 still get fixes. A store on the latest release of its branch has them.

How to check your own store#

1. Run the PrestaShop security check. It is free and takes a few seconds. It lists the modules on the home page that have an advisory, and for each one it says whether to update, check, or replace it. It also looks for the card skimmer PrestaShop warned about in 2026.
2. Compare the versions in the back office. Under Modules, the version of every module is shown. For each module the check marks as "check", open its advisory and see whether your version is newer than the fix.
3. Remove what you do not use. A disabled module can still have files open on the server. If you no longer need it, uninstall it and delete it.
4. Replace modules that have no fix. No later version will fix them.
5. On 1.7 or 1.6, plan the upgrade. Updating modules helps, but the core stays open. The way from 1.7 goes through 8.2 to 9; see Upgrading to PrestaShop 9.

Or hand it over: we update the modules and the core on a copy of the store, test the checkout and switch over, for a fixed price agreed before any work. Ask for a price.

How we checked#

• Stores: the 2,066 PrestaShop stores of our November 2026 study, among the 100,000 websites people in France visit most. The method is described there.
• Modules: the modules the home page loads, read from its code. Modules that only work in the back office or on other pages are not seen. The version comes from the module's public config.xml where the server serves it.
• Advisories: module advisories by Friends of Presta (CC BY-SA 4.0) and core advisories by PrestaShop on GitHub, both as of 7 November 2026. A module is matched by its technical name. A fork or a module with the same name by another author would be counted too.
• Limits: stores that leave config.xml open may not be like the others, so the 67% is a picture of those 302 modules, not of all stores. A store can also have patched a module by hand without changing its version.
• Privacy: we publish only totals. We did not contact the stores, and we will not name them.

Want to see a particular store? Enter its address in the PrestaShop security check.