CVE-2026-47743

Name of the Vulnerable Software and Affected Versions Shopper versions prior to 2.8.0

Description Three related defects in admin Livewire components allow data tampering, sensitive data disclosure, and stored Cross-Site Scripting (XSS). First, several components expose Eloquent model identifiers as public properties without the #[Locked] attribute, allowing authenticated users to rewrite the wire payload to target any record ID and bypass implicit scoping. Second, the Customers/Create::store() function re-passes a Hidden password form field into the create payload, causing plaintext passwords to be rendered in the HTML and transported through the Livewire snapshot in clear text. Third, the product barcode field is rendered via DNS1DFacade::getBarcodeHTML() using unescaped output, allowing users with edit products permissions to persist malicious payloads that execute in the browsers of other admin users, potentially leading to session theft.

Recommendations Update to version 2.8.0.