# joomshaper.com Easy Store extension for Joomla.

Every CVE that names joomshaper.com Easy Store extension for Joomla among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0](https://agentprime.io/advisories/CVE-2026-90903.md)
  `CVE-2026-90903` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 7.2 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0](https://agentprime.io/advisories/CVE-2026-90901.md)
  `CVE-2026-90901` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0](https://agentprime.io/advisories/CVE-2026-90905.md)
  `CVE-2026-90905` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 7.2 High · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control, Cross-site request forgery (CSRF)
- [Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0](https://agentprime.io/advisories/CVE-2026-90902.md)
  `CVE-2026-90902` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0](https://agentprime.io/advisories/CVE-2026-90904.md)
  `CVE-2026-90904` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control
- [Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0](https://agentprime.io/advisories/CVE-2026-90899.md)
  `CVE-2026-90899` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 8.2 High · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure, Broken access control
- [Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0](https://agentprime.io/advisories/CVE-2026-90900.md)
  `CVE-2026-90900` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1](https://agentprime.io/advisories/CVE-2026-65759.md)
  `CVE-2026-65759` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 23 Jul 2026 · Tags: Broken access control
- [Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1](https://agentprime.io/advisories/CVE-2026-65761.md)
  `CVE-2026-65761` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1](https://agentprime.io/advisories/CVE-2026-65760.md)
  `CVE-2026-65760` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Information disclosure, Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=joomshaper-com-easy-store-extension-for-joomla>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/joomshaper-com-easy-store-extension-for-joomla/>. Everything for agents: <https://agentprime.io/llms.txt>.