CVE-2021-33562: Shopizer

Medium severity, CVSS 4.8. EPSS: 2.9% chance of exploitation in the next 30 days.

A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.

Affected products

• Shopizer Shopizer: before 2.17.0 (fixed in 2.17.0)

Published 2021-05-24. Last modified 2026-06-17.