PatchTheCVEnopcommerce vulnerabilities
Recent CVEs affecting nopcommerce products. 8 tracked.
nopcommerce has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2025-12-16. Highest priority: CVE-2025-65593 (score 36/100).
- CVE-2025-65593 HIGH 8.8 DOWNGRADE nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality.
- CVE-2025-65589 MEDIUM 6.1 DOWNGRADE nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality.
- CVE-2025-65592 MEDIUM 6.1 DOWNGRADE nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality
- CVE-2025-65591 MEDIUM 5.4 DOWNGRADE nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.
- CVE-2025-65590 MEDIUM 5.4 DOWNGRADE nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content
- CVE-2021-42193 MEDIUM 6.1 DOWNGRADE nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]
- CVE-2024-58248 LOW 3.5 UPGRADE nopCommerce through 4.90.1 does not offer locking for order placement
- CVE-2024-38963 MEDIUM 6.1 DOWNGRADE Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "
FAQ
How do I fix nopcommerce vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nopcommerce being exploited right now?
None of the tracked nopcommerce CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nopcommerce CVE should I patch first?
CVE-2025-65593 currently ranks highest (36/100): nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality..