Livewire
Monthly
Privilege escalation in Shopper 2.0.0 through 2.5.x allows an authenticated admin-panel user who holds only the access_dashboard permission to create new administrator accounts or grant elevated permissions by invoking CreateTeamMember::store() or Permissions::togglePermission() directly through /livewire/update. The missing server-side authorization checks make this a genuine privilege-escalation path for low-privilege back-office accounts; upgrading to 2.6.0 adds the required authorize() guards. No public exploit identified at time of analysis, and exploitation requires a valid authenticated session rather than anonymous internet access.
Rapyd Admin 9.0.0 through 9.19.x lets an authenticated company member holding the default `customer` role hijack arbitrary accounts through the Livewire `UsersModalEditEmbed` component: `editUser`, `save` and `deleteUser` trust a user id supplied by the browser and validate only a permission, so a low-privileged member can reset an owner's or super admin's password, promote themselves to `owner`, and delete users. Exploitation requires a logged-in account with the default `customer` role (which carries `edit own users`) and predictable sequential user ids - per the vendor changelog public self-registration is open, so any attacker can obtain that role, and no other non-default configuration is needed. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); vendor-released fix: 9.20.0 (the changelog attributes the security release to 9.19.0).
Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) that allows unauthenticated attackers to execute commands through improper hydration of component property updates. KEV-listed with EPSS 16%, this vulnerability affects one of the most popular PHP frameworks, potentially compromising thousands of Laravel applications using Livewire for reactive server-side rendering.
Prototype pollution in Livewire's client-side query-string parser enables reflected cross-site scripting against applications running versions 3.0.0-beta.1 through 3.8.2 or 4.0.0 through 4.3.3. The dot-notated URL parser in js/plugins/history/index.js accepts __proto__, constructor, and prototype as path segments, injecting attacker-controlled values into Object.prototype; multiple effect handlers then read effects.html, effects.js, effects.xjs, and effects.scripts without hasOwnProperty guards, treating inherited values as trusted server-delivered directives and executing arbitrary JavaScript in the application's origin. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and zero-privilege requirement make this a meaningful risk for all unpatched Livewire deployments.
Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Privilege escalation in Shopper 2.0.0 through 2.5.x allows an authenticated admin-panel user who holds only the access_dashboard permission to create new administrator accounts or grant elevated permissions by invoking CreateTeamMember::store() or Permissions::togglePermission() directly through /livewire/update. The missing server-side authorization checks make this a genuine privilege-escalation path for low-privilege back-office accounts; upgrading to 2.6.0 adds the required authorize() guards. No public exploit identified at time of analysis, and exploitation requires a valid authenticated session rather than anonymous internet access.
Rapyd Admin 9.0.0 through 9.19.x lets an authenticated company member holding the default `customer` role hijack arbitrary accounts through the Livewire `UsersModalEditEmbed` component: `editUser`, `save` and `deleteUser` trust a user id supplied by the browser and validate only a permission, so a low-privileged member can reset an owner's or super admin's password, promote themselves to `owner`, and delete users. Exploitation requires a logged-in account with the default `customer` role (which carries `edit own users`) and predictable sequential user ids - per the vendor changelog public self-registration is open, so any attacker can obtain that role, and no other non-default configuration is needed. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); vendor-released fix: 9.20.0 (the changelog attributes the security release to 9.19.0).
Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) that allows unauthenticated attackers to execute commands through improper hydration of component property updates. KEV-listed with EPSS 16%, this vulnerability affects one of the most popular PHP frameworks, potentially compromising thousands of Laravel applications using Livewire for reactive server-side rendering.
Prototype pollution in Livewire's client-side query-string parser enables reflected cross-site scripting against applications running versions 3.0.0-beta.1 through 3.8.2 or 4.0.0 through 4.3.3. The dot-notated URL parser in js/plugins/history/index.js accepts __proto__, constructor, and prototype as path segments, injecting attacker-controlled values into Object.prototype; multiple effect handlers then read effects.html, effects.js, effects.xjs, and effects.scripts without hasOwnProperty guards, treating inherited values as trusted server-delivered directives and executing arbitrary JavaScript in the application's origin. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and zero-privilege requirement make this a meaningful risk for all unpatched Livewire deployments.
Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.