Shopper is a head‑less e‑commerce admin panel that, before version 2.8.0, had three related defects in its Livewire components. First, several admin components exposed Eloquent model identifiers as public properties without the #[Locked] attribute, letting authenticated users rewrite the Livewire payload to target arbitrary record IDs and bypass the routing‑based scoping, thereby allowing data tampering and unintended data disclosure. Second, the Customers/Create::store() endpoint forwarded a hidden _password form field straight into the payload; the clear‑text password was rendered into the HTML and sent back in the Livewire snapshot, exposing credentials in the page DOM and in any server logs that capture the snapshot. Third, the product barcode field was rendered by DNS1DFacade::getBarcodeHTML() using raw {!! !!} syntax; an admin with edit_products permission could persist malicious payload in the barcode value that would execute in the browser of any admin viewing that product, causing stored XSS and enabling session theft and privilege escalation. Starting in v2.8.0, the Livewire model identifiers are locked, the password round‑tripping is removed and the plaintext password is hashed before response, and the barcode content is escaped before being passed to the generator and wrapped in an SVG context that does not interpret event handlers. These issues are classified as CWE‑200, CWE‑639, and CWE‑79.

Shopper Labs’ Shopper product. Versions prior to 2.8.0 are affected; all releases 2.8.0 and later contain mitigations that lock Livewire model identifiers, remove plaintext credential round‑tripping, and escape barcode content.

The flaw carries a CVSS score of 8.7, indicating high severity. The EPSS score is below 1%, suggesting a low but non‑zero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need a valid authenticated session in the admin interface and, for the XSS component, the edit_products permission. By forging Livewire requests or inserting malicious content into the barcode field, a threat actor could tamper with data records, exfiltrate sensitive information, or persist malicious scripts across admin sessions, effectively achieving session theft and privilege escalation. The mitigations deployed in v2.8.0 prevent these attack paths by restricting identifier access, eliminating plaintext credential round‑tripping, and escaping user data in barcode rendering.