CVE-2026-47743: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in shopperlabs shopper
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. Second, `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. Finally, the product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining. Starting in v2.8.0, all vulnerable Livewire model identifiers are now marked `#[Locked]`; `Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client; and the product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `<svg>` context that does not interpret event handlers. No known workarounds are available.
AI Analysis
Technical Summary
CVE-2026-47743 describes three related vulnerabilities in shopperlabs shopper prior to version 2.8.0 affecting admin Livewire components. First, public exposure of Eloquent model identifiers without the #[Locked] attribute allowed authenticated users to manipulate wire payloads to access or modify unauthorized records, bypassing routing scoping. Second, the Customers/Create::store() method passed a Hidden _password form field in plaintext through the Livewire snapshot, exposing credentials in the DOM and logs. Third, the product barcode field was rendered unsafely with {!! !!} via DNS1DFacade::getBarcodeHTML(), enabling stored XSS for users with edit_products permission. Version 2.8.0 fixes these by marking identifiers as #[Locked], hashing passwords before client exposure, and escaping barcode values with SVG context to prevent event handler execution. No known exploits are reported, and no workarounds exist.
Potential Impact
An authenticated user with limited privileges can exploit these vulnerabilities to tamper with data records beyond their scope, disclose plaintext passwords through the admin interface, and execute stored XSS attacks in the browsers of other admin users. This can lead to session theft, privilege escalation, and unauthorized data access. The CVSS score of 8.7 reflects high impact on confidentiality and integrity with no impact on availability.
Mitigation Recommendations
Version 2.8.0 of shopperlabs shopper includes official fixes for all described vulnerabilities. Users should upgrade to version 2.8.0 or later to remediate these issues. No workarounds are available. Patch status is not explicitly confirmed beyond the vendor's version 2.8.0 release; verify with vendor advisory for current remediation guidance.
CVE-2026-47743: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in shopperlabs shopper
Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. Second, `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. Finally, the product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining. Starting in v2.8.0, all vulnerable Livewire model identifiers are now marked `#[Locked]`; `Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client; and the product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `<svg>` context that does not interpret event handlers. No known workarounds are available.
CVSS v3.1
Score 8.7high
Affected software
pkg:github/shopperlabs/shopperRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-47743 describes three related vulnerabilities in shopperlabs shopper prior to version 2.8.0 affecting admin Livewire components. First, public exposure of Eloquent model identifiers without the #[Locked] attribute allowed authenticated users to manipulate wire payloads to access or modify unauthorized records, bypassing routing scoping. Second, the Customers/Create::store() method passed a Hidden _password form field in plaintext through the Livewire snapshot, exposing credentials in the DOM and logs. Third, the product barcode field was rendered unsafely with {!! !!} via DNS1DFacade::getBarcodeHTML(), enabling stored XSS for users with edit_products permission. Version 2.8.0 fixes these by marking identifiers as #[Locked], hashing passwords before client exposure, and escaping barcode values with SVG context to prevent event handler execution. No known exploits are reported, and no workarounds exist.
Potential Impact
An authenticated user with limited privileges can exploit these vulnerabilities to tamper with data records beyond their scope, disclose plaintext passwords through the admin interface, and execute stored XSS attacks in the browsers of other admin users. This can lead to session theft, privilege escalation, and unauthorized data access. The CVSS score of 8.7 reflects high impact on confidentiality and integrity with no impact on availability.
Mitigation Recommendations
Version 2.8.0 of shopperlabs shopper includes official fixes for all described vulnerabilities. Users should upgrade to version 2.8.0 or later to remediate these issues. No workarounds are available. Patch status is not explicitly confirmed beyond the vendor's version 2.8.0 release; verify with vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-19T22:16:39.504Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6254f59c2644c7f8773e92
Added to database: 07/23/2026, 17:52:53 UTC
Last enriched: 07/23/2026, 18:07:19 UTC
Last updated: 07/23/2026, 18:52:46 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.