HIKASHOP ESSENTIAL 60€The basic version. With the main features for a little shop.
HIKAMARKETAdd-on Create a multivendor platform. Enable many vendors on your website.
HIKASERIALAdd-on Sale e-tickets, vouchers, gift certificates, serial numbers and more!
MARKETPLACEPlugins, modules and other kinds of integrations for HikaShop
HikaShop 6.6.0 gives your shop a mobile application. It is free, it runs your shop from your phone, and you connect it by scanning a QR code. It rests on a real API, which anything else you write can use too. The release also puts the whole checkout on a product page, rebuilds the affiliate page your partners see, brings HikaShop to the command line, adds several languages to a WordPress shop, imports your categories, and draws every graph itself instead of asking Google. It also fixes a security issue in the Bambora (Beanstream) payment plugin. In total this release brings 12 new features, 44 improvements, and 86 bug fixes.
Here is a look at the highlights of this release.
Five new plugins have arrived on the marketplace this summer, and a good number of the ones you already use have been updated. Here is what is new, and what changed under you.
Everything below is on the marketplace.
HikaShop 6.5.1 is a big release. It makes the storefront markedly faster with full-text product search and a switch to the InnoDB database engine, adds calendar-based product variants, PayPal express checkout, next-generation AVIF images, smarter product filters and per-product option controls, and lands a large round of WordPress, product-page, filter and payment fixes. In total this release brings 20 new features, 17 improvements, and 51 bug fixes.
Here is a look at the highlights of this release.
Five more plugins have arrived on the marketplace since our last round-up, four of them free, one putting your products in your customers' living rooms, and the plugin which draws your PDF invoices has been rebuilt on a maintained library. Here is what is new, and what changed under you.
Everything below is on the marketplace.
HikaShop 6.6.0 fixes a high severity vulnerability in the Bambora (Beanstream) payment plugin shipped with HikaShop, reported to us through the Joomla security team. On the shops concerned, someone who knew the id of an order could have that order marked as paid without any payment having been made.
Here is what the issue was, how to know whether your shop is concerned, and what to do.
HikaShop 6.5.2 is a maintenance release. It fixes a security issue along with several bugs, and we recommend that all merchants update.
We fixed a medium severity open redirect vulnerability in the currency switcher. When a visitor changed the currency, HikaShop could send them back to an address passed in the link. A specially crafted link, using a doubly encoded web address, could get past the safety check and send the visitor to an external website instead of back to your shop.
This kind of flaw does not expose any data by itself, but it can be abused in phishing: an attacker sends a link that starts on your genuine domain and then bounces the visitor to a look-alike site. The visitor sees your address at first and is more easily fooled.
Affected versions: all editions of HikaShop (Starter, Essential and Business), from the earliest versions up to and including 6.5.1. The issue is fixed in 6.5.2, released today, the 20th of July 2026.
The address a visitor is sent back to is now fully decoded and checked before the redirection, so only addresses on your own site are accepted.
Because this fix concerns security, we advise every merchant to update to 6.5.2 as soon as possible, using the one click updater in your back-end or the package from your member area.
HikaShop 6.5.2 also includes a number of other bug fixes. You can see the full list in the change log.
If you are on an older version and cannot update to 6.5.2 immediately, you can apply the security fix by hand. Open the front-end currency controller, the file components/com_hikashop/controllers/currency.php, and find these two lines:
if(hikashop_disallowUrlRedirect($url)) return false; $app->redirect(urldecode($url));
Replace them with:
$url = urldecode($url); if(hikashop_disallowUrlRedirect($url)) return false; $app->redirect($url);
The same two lines are also present in the back-end controller, administrator/components/com_hikashop/controllers/currency.php; apply the same change there. This decodes the return address first and then checks the exact address the visitor will be sent to, so the safety check can no longer be bypassed. Clear your Joomla cache afterwards.
HikaShop 6.5.0 adds bulk import for discounts and coupons, cleanly separates guest and registered customer records, sharpens your SEO links and structured data, supports fully headless command-line installs, and strengthens Joomla 6 and WordPress 7 compatibility. In total this release brings 5 new features, 11 improvements, and 63 bug fixes.
Here is a look at the highlights of this release.
HikaShop 6.4.1 strengthens WordPress compatibility, adds recurring payment support to PayPal Checkout, improves the currency rounding system, and includes 54 bug fixes, 32 improvements, and 14 new features.
Here is a look at the highlights of this release.
E-invoicing is becoming mandatory across Europe. Belgium's mandate is already in effect, Germany requires businesses to accept e-invoices since January 2025, and France's mandate starts in September 2026. Here is a guide to help you understand what is changing, when it affects you, and how HikaShop can help you stay compliant.
Read on for country-by-country timelines, invoice format explanations, and our ready-to-use solutions.
