EUVD-2026-64063
GHSA-42m7-jqh7-g85c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no auth required (guest checkout, PR:N); user interaction required as admin must view order (UI:R); scope changes to admin browser session (S:C); confidentiality and integrity impacts are limited at the XSS layer but escalate if session is hijacked.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla's Input::getArray() combined with PHP's variables_order=EGPCS (Cookie overrides POST in $_REQUEST ) to store unsanitized HTML in fields such as billing_first_name.
AnalysisAI
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious scripts via guest checkout billing address fields, affecting all versions from 1.0.0 through 4.1.5. The exploit abuses an interaction between Joomla's Input::getArray() sanitization and PHP's default variables_order=EGPCS setting, where Cookie values silently override POST parameters in $_REQUEST, allowing unsanitized HTML to persist in fields such as billing_first_name. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must submit a guest checkout without authentication - PR:N is confirmed by the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L) reflects a high-severity attack that is network-accessible, requires no authentication, and imposes no special attack requirements, but depends on a privileged backend user actively viewing the malicious order record before the payload fires. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker visits the J2Store guest checkout page and submits a purchase order with a crafted Cookie header containing a JavaScript payload (for example, a session cookie exfiltration script) as the value for billing_first_name. PHP's EGPCS variable merge order causes this Cookie value to override the legitimate POST value in $_REQUEST, so Joomla's Input::getArray() sanitizes the benign POST value while the malicious Cookie value is stored verbatim in the database. … |
| Remediation | Check https://www.j2commerce.com/ for a patched release of J2Store or J2Commerce; no specific fixed version number was confirmed in the provided intelligence data, so the exact upgrade target must be verified directly with the vendor before updating. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all systems running J2Store or J2Commerce, determine current versions, and document whether guest checkout is enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in J2Store Extension For Joomla
View allOrder content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20,
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, an
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment d
Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today