OXID eShop 7.5.0

Release date: June 2, 2026

With OXID eShop 7.5, three connected developments come together: marketing teams gain more control over content, the platform becomes more open to integrations and individual services, and OXID eShop continues to modernize its technical foundation — without forcing migration on existing projects. Below, we want to highlight the most important changes.

For a short and more technical overview of the changes, see our Release Notes.

More Control for Marketing Teams

With OXID eShop 7.5, the Content & Media Bundle is updated to version 10. In particular, Visual CMS has been comprehensively modernized and extended with features that give marketing teams more autonomy in their daily work.

Anything-First Editing

Content no longer has to start with a fixed layout structure. Instead, the marketing team decides which element a piece of content begins with — whether a text widget, an image, a row, or a column. This speeds up creation and offers more design freedom while keeping the existing structural framework intact. More on this in Handling widgets.

Nested Activity Groups with AND/OR Logic

Already in Content & Media Bundle 9, widgets could be shown and hidden on a schedule. Visual CMS 10 builds on that: multiple activity periods can now be combined into nested groups — with logical connections and exclusion periods. This makes more complex scenarios such as “weekdays at lunchtime, but not on public holidays” possible without manual intervention.

WYSIWYG Editor 7

The WYSIWYG Editor and Media Library are included in all editions (CE, PE, EE, B2B) — two of three modules in the Content & Media Bundle are therefore standard in every OXID edition. Once the WYSIWYG Editor is activated, every admin text field becomes rich-text-enabled with Media Library access: product and category descriptions, CMS pages, descriptions for payment and shipping methods, and other text-based fields.

In OXID eShop 7.5, new extension points are added: modules can extend the editor with custom plugins and options via Twig blocks; a new console command applies alt texts already maintained in the Media Library to existing content.

Media Upload Security

The Media Library now checks uploaded files for content, MIME type, and file name. SVG files containing scripts, <foreignObject> elements, on* event handlers, or javascript:/data: URLs are rejected; raster images that do not parse as a valid image are rejected as well. File names containing path-traversal characters are blocked, and the actual content of a file must match the declared file type. Common attack vectors via manipulated uploads can be blocked this way — without any code adjustments.

Platform More Open and Integration-Ready

Beyond the Content & Media Bundle, OXID eShop 7.5 opens the core in several places for individual solutions. Three of the following building blocks — the API entrypoint, the replaceable search service, and the new email transport — follow the same pattern: they open the shop core at clearly defined interfaces without having to replace it.

API Entrypoint with Symfony Routes

A new API layer (api.php) based on the Symfony HttpKernel allows custom REST endpoints to be built without modifying the shop core. Routes are declared via PHP 8 #[Route] attributes; four authentication models (public, JWT token, frontend session, admin session) are available. A built-in API rate limiter limits the number of concurrent requests and protects the shop from load spikes.

Replaceable Search Service

With the new ProductSearchServiceInterface, the product search can be replaced with a custom implementation — for example, a search that connects to an external search index or a specialized service. The standard search remains unchanged for all existing shops.

HTML Sanitizer for CMS Content

OXID eShop 7.5 includes an integrated HTML sanitizer as a framework building block for cleaning HTML content. It is based on the Symfony HtmlSanitizer and is disabled by default — projects activate it explicitly via a service parameter, define allow/deny rules, and use the new Twig filter sanitize_html in the templates where it should take effect. This allows the XSS attack vector for CMS content to be addressed systematically, without automatically changing existing shops.

New Email Service

OXID eShop 7.5 includes a new email service based on the Symfony Mailer. Clean interfaces and an extensible architecture allow the integration of additional mail transports via the available Symfony Mailer configurations — without core modifications. The existing Core/Email delivery continues to work in parallel during the 7.x series; new modules can use the MailerInterface directly.

Modernization Without Migration Pressure

In the background, the technical foundation of OXID eShop is continuously updated. With 7.5, this happens again within a clear, predictable framework.

Content & Media Bundle: three versions in parallel

The OXID eShop 7.5 compilation supports three versions of the Content & Media Bundle in parallel: Bundle 10 as the recommended standard, Bundle 9 as a maintained stay-on option, and Bundle 8 as a transition option. The choice is made once per installation via a Composer preconfiguration — analogous to the Smarty/Twig transition in 7.0.

Shops currently on Bundle 9 can move to Bundle 10 without content migration. The step from Bundle 8 to Bundle 10 requires a content migration; the necessary tooling (ddoevisualcms:migrate:veparse-to-vetree, ddoevisualcms:migrate:urls-to-ids, ddoewysiwyg:migrate:urls-to-ids) is part of the compilation and documented in the bundle documentation.

Note

Bundle 8 is no longer being developed and does not receive security fixes. A migration to Bundle 10 should be planned for Bundle 8 shops — the migration steps are documented.

PHP 8.5

OXID eShop 7.5 supports PHP 8.3, 8.4, and 8.5. PHP 8.2 is no longer supported in 7.5 — anyone running the shop on PHP 8.2 should update the hosting environment before upgrading. PHPUnit has been raised from version 10 to version 12.

OXID follows a half-yearly release cycle with two alternating focuses. The naming reflects the development phase:

Winter editions (odd minor versions — for example 7.3 and 7.5) are developed over the winter and integrate the new PHP version released in late autumn of the previous year. They are typically released in the following early summer.
Summer editions (even minor versions — for example 7.2, 7.4, and in the future 7.6) are developed over the summer and focus on new functionality and stability without changing the PHP version. They are typically released in December.

This keeps the platform predictably up to date without requiring you to wait for a major platform upgrade.

Performance Improvements

Several targeted optimizations improve page load times:

Empty baskets are detected early — no unnecessary calculations on every page load.
Deactivated modules no longer affect shop frontend rendering time.
Unnecessary instantiations of the basket component have been eliminated.

In the background, additional caches take effect — for example for configuration lookups, module lookups, and edition and cache directory lookups.

The impact varies depending on shop size, number of modules, and load; in particular, busy shops with many active modules will notice the effect in everyday operation — without requiring any code changes.

Bootstrap 3 Cleanup in the APEX Theme

Remnants from the Bootstrap 3 era have been removed from the APEX theme. This reduces the codebase and avoids conflicts with custom adjustments built on more recent Bootstrap versions.

We also continue to improve the security of the platform during ongoing operation — for example, by removing sensitive parameters from internal redirects. The exact changes can be found in the technical Release Notes.

Impact on existing projects

Update recommendation: OXID eShop 7.5 is the active line with full support; Bundle 10 is the recommended content stack. Customers on 7.4.x can move to 7.5 with Bundle 9 without content migration and adopt Bundle 10 later.
PHP version: Minimum is PHP 8.3. Anyone still running the shop on PHP 8.2 must update the hosting environment before the update.
Content & Media Bundle: Three versions available in parallel (Bundle 10, 9, 8); Bundle 8 receives no further development or security fixes — migration to Bundle 10 recommended.
Own extensions: API entrypoint, replaceable search service, and HTML sanitizer are opt-in — existing shops remain unchanged without explicit activation.
Performance improvements: Included automatically with the update, no configuration work required.

Consistency Check Tool — Filter Framework

Independent of the Compilation, the OXID eShop Consistency Check Tool remains available as an optional command-line utility that can be installed additionally on demand. Introduced with 7.3, it has been extended with a filter framework. This allows data maintenance tasks to be limited to specific records — for example, only inactive customers or orders from a defined period. The tool then analyzes and cleans up more selectively without putting production data at risk.

Your Feedback Matters

We look forward to your feedback on the new version OXID eShop 7.5.

Whether technical experiences, suggestions for improvement, or use cases from your projects — your feedback helps us further develop the OXID eShop platform and better meet your requirements.

You can reach us directly at produktmanagement@oxid-esales.com.