J2Store CVE-2026-78000

Exploitation requires that a victim user browse a Joomla site running an affected J2Store version (1.0.0-3.3.21, 4.0.0-4.0.21, or 4.1.0-4.1.6) and follow a crafted link supplied by the attacker - passive user interaction is mandatory. No attacker authentication or prior account access is required. The open-redirect variant requires that the affected task-handler endpoints be reachable by the attacker and that the victim follow the crafted redirect URL. No non-default server configuration is required beyond having J2Store installed. Exploitation is constrained by the victim-interaction requirement (UI:P); there is no server-side code execution path, and impact is confined to the victim's browser session and trust relationship with the shop domain.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P) correctly characterises medium severity: the attack is network-accessible and requires no credentials, but passive victim interaction - following a crafted link - is a prerequisite that limits automated mass exploitation. The open-redirect component meaningfully raises real-world phishing risk because attackers can wrap malicious destinations inside legitimate shop domain URLs, significantly improving click-through rates on phishing lures targeting e-commerce customers. No EPSS data was provided, and the absence from CISA KEV is consistent with the typical trajectory of Joomla extension XSS: these are commonly exploited in opportunistic, targeted campaigns rather than automated sweeps. SSVC signals: exploitation status unconfirmed, automatable (simple GET request with crafted payload), technical impact partial (limited C/I per CVSS). Overall this is a concrete but bounded risk whose primary business impact is session-credential theft and phishing facilitation against shop visitors.

An attacker crafts a URL to a J2Store product listing page with a <script> payload embedded in the filter_tag parameter and distributes it via a targeted phishing email to the shop's customer base. When a customer clicks the link, the unencoded parameter value is reflected into the page HTML and executes in the victim's browser, exfiltrating session cookies to an attacker-controlled server. In a parallel campaign the attacker supplies a base64-encoded external URL to one of the four unvalidated task handlers, causing the trusted shop domain to silently redirect visiting customers to a credential-harvesting clone site.