JoomShopping CVE-2026-63264

Q: What is the CVSS score of CVE-2026-63264?

CVE-2026-63264 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-47619 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-22 security@joomla.org

GHSA-v36m-hw3w-whpw

XSS

5.3

CVSS 4.0 · Vendor: joomla

Severity by source

Vendor (joomla) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Reflected XSS requires no privileges and no special configuration but mandates victim interaction; scope changes to victim browser session with limited confidentiality and integrity impact, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (joomla).

CVSS VectorVendor: joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:32 vuln.today

DescriptionCVE.org

The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.

AnalysisAI

Reflected XSS in JoomShopping's product frontend controller allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The flaw affects Joomla-based e-commerce sites running the JoomShopping extension, and successful exploitation could enable session hijacking, credential theft, or malicious page manipulation targeting shoppers. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Technical ContextAI

JoomShopping is a third-party e-commerce extension for the Joomla CMS. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - XSS), specifically the reflected (non-persistent) variant, meaning attacker-controlled input passed via URL parameters is embedded directly in the HTTP response without proper output encoding. The vulnerable component is the product frontend controller, which likely processes query parameters such as product search terms, category filters, or product identifiers that are echoed back into the rendered HTML without sanitization. No CPE strings were included in the available intelligence, so exact affected version ranges cannot be confirmed from this data set alone.

RemediationAI

Update JoomShopping to the latest patched release as directed by the vendor; consult the advisory at https://www.joomshopping.com/ for the exact fixed version, which was not specified in the available data - a precise fix version cannot be cited here without that confirmation. As an interim measure if patching is not immediately possible, deploy a Web Application Firewall (WAF) rule to block or sanitize requests containing common XSS payloads in parameters processed by the product frontend controller, noting that overly broad WAF rules may generate false positives on legitimate product search or filter queries. Restricting public unauthenticated access to JoomShopping product pages would eliminate the external attack surface entirely but would impair normal e-commerce functionality. Content Security Policy (CSP) headers configured to restrict inline script execution provide an additional browser-side mitigation layer with minimal trade-offs.