# JoomShaper Easy Store vulnerabilities Source: https://junglewise.ai/threats/technologies/easy-store Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/easy-store.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 9 vulnerabilities in JoomShaper Easy Store: 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-90905, was published on 23 September 2026. Nothing in the last four weeks, down from 6 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 6 - All time: 9 (0 critical, 0 exploited in the wild) ## About JoomShaper Easy Store Joomla extension for creating and managing online stores. ## Latest JoomShaper Easy Store vulnerabilities - [CVE-2026-90905: Joomla Easy Store extension missing CSRF and access control](https://junglewise.ai/threats/cve-2026-90905-joomla-extension-joomshaper-com-missing-csrf-and-access-control) (info, published 23 Sep 2026) - [CVE-2026-90904: Joomla Easy Store extension access control bypass in ApiController](https://junglewise.ai/threats/cve-2026-90904-joomla-extension-joomshaper-com-broken-access-control-acl-bypass) (info, published 23 Sep 2026) - [CVE-2026-90903: Joomla Easy Store extension missing CSRF token verification in AJAX endpoints](https://junglewise.ai/threats/cve-2026-90903-joomla-extension-joomshaper-com-missing-csrf-token-verification) (info, published 23 Sep 2026) - [CVE-2026-90902: Joomla Easy Store SQL injection in coupon bulk update](https://junglewise.ai/threats/cve-2026-90902-joomla-extension-joomshaper-com-authenticated-privileged-sql) (info, published 23 Sep 2026) - [CVE-2026-90901: Joomla Easy Store SQL injection in media deletion](https://junglewise.ai/threats/cve-2026-90901-joomla-extension-joomshaper-com-authenticated-privileged-sql) (info, published 23 Sep 2026) - [CVE-2026-90900: Joomla Easy Store CSRF vulnerability in product review submission](https://junglewise.ai/threats/cve-2026-90900-joomla-extension-joomshaper-com-missing-csrf-token-verification) (info, published 23 Sep 2026) - [CVE-2026-65761: JoomShaper EasyStore SQL injection in product list sorting](https://junglewise.ai/threats/cve-2026-65761-joomshaper-easystore-sql-injection-in-product-list-sorting) (info, CVSS 9.3, published 23 Jul 2026) - [CVE-2026-65760: JoomShaper Easy Store improper access control in order views](https://junglewise.ai/threats/cve-2026-65760-joomshaper-easy-store-improper-access-control-in-order-views) (info, CVSS 9.2, published 23 Jul 2026) - [CVE-2026-65759: JoomShaper Easy Store unauthenticated order forgery in checkout repay task](https://junglewise.ai/threats/cve-2026-65759-joomshaper-easy-store-unauthenticated-order-forgery-in-checkout) (info, CVSS 8.7, published 23 Jul 2026) ## Most severe JoomShaper Easy Store vulnerabilities - [CVE-2026-65761: JoomShaper EasyStore SQL injection in product list sorting](https://junglewise.ai/threats/cve-2026-65761-joomshaper-easystore-sql-injection-in-product-list-sorting) (info, CVSS 9.3, published 23 Jul 2026) - [CVE-2026-65760: JoomShaper Easy Store improper access control in order views](https://junglewise.ai/threats/cve-2026-65760-joomshaper-easy-store-improper-access-control-in-order-views) (info, CVSS 9.2, published 23 Jul 2026) - [CVE-2026-65759: JoomShaper Easy Store unauthenticated order forgery in checkout repay task](https://junglewise.ai/threats/cve-2026-65759-joomshaper-easy-store-unauthenticated-order-forgery-in-checkout) (info, CVSS 8.7, published 23 Jul 2026) - [CVE-2026-90901: Joomla Easy Store SQL injection in media deletion](https://junglewise.ai/threats/cve-2026-90901-joomla-extension-joomshaper-com-authenticated-privileged-sql) (info, published 23 Sep 2026) - [CVE-2026-90904: Joomla Easy Store extension access control bypass in ApiController](https://junglewise.ai/threats/cve-2026-90904-joomla-extension-joomshaper-com-broken-access-control-acl-bypass) (info, published 23 Sep 2026) - [CVE-2026-90905: Joomla Easy Store extension missing CSRF and access control](https://junglewise.ai/threats/cve-2026-90905-joomla-extension-joomshaper-com-missing-csrf-and-access-control) (info, published 23 Sep 2026) - [CVE-2026-90902: Joomla Easy Store SQL injection in coupon bulk update](https://junglewise.ai/threats/cve-2026-90902-joomla-extension-joomshaper-com-authenticated-privileged-sql) (info, published 23 Sep 2026) - [CVE-2026-90903: Joomla Easy Store extension missing CSRF token verification in AJAX endpoints](https://junglewise.ai/threats/cve-2026-90903-joomla-extension-joomshaper-com-missing-csrf-token-verification) (info, published 23 Sep 2026) - [CVE-2026-90900: Joomla Easy Store CSRF vulnerability in product review submission](https://junglewise.ai/threats/cve-2026-90900-joomla-extension-joomshaper-com-missing-csrf-token-verification) (info, published 23 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 6 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 6 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other JoomShaper technologies - [JoomShaper SP Page Builder](https://junglewise.ai/threats/technologies/sp-page-builder): 10 vulnerabilities - [JoomShaper Helix-Ultimate](https://junglewise.ai/threats/technologies/helix-ultimate): 9 vulnerabilities - [JoomShaper SP Property](https://junglewise.ai/threats/technologies/sp-property): 6 vulnerabilities - [JoomShaper SP Page Builder Pro](https://junglewise.ai/threats/technologies/sp-page-builder-pro): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "JoomShaper Easy Store vulnerabilities", https://junglewise.ai/threats/technologies/easy-store, 9 November 2026.