Shopizer versions up to 2.16.0 contain multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class. These flaws allow attackers with valid credentials to inject malicious scripts or HTML via crafted payloads in the getInputStream() or getReader() functions. The vulnerabilities have a medium severity with a CVSS score of 5.4.