EUVD-2026-70446
GHSA-3p2h-qrvh-pqvm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reflected XSS needs no auth and no complexity, but victim must click a crafted link (UI:R); scope changes to victim's browser (S:C); no availability impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - j2commerce.com - Reflected XSS via filter_tag, pricefrom and priceto in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.
AnalysisAI
Reflected XSS and open-redirect flaws in J2Store, a Joomla e-commerce extension by j2commerce.com, allow unauthenticated network attackers to inject malicious scripts into victim browsers via the filter_tag, pricefrom, and priceto parameters across all 3.x releases through 3.3.21 and all 4.x releases through 4.1.6. Four task handlers additionally accept base64-encoded redirect URLs without destination-host validation, enabling phishing attacks that abuse the shop's trusted domain to mislead customers into visiting attacker-controlled sites. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a victim user browse a Joomla site running an affected J2Store version (1.0.0-3.3.21, 4.0.0-4.0.21, or 4.1.0-4.1.6) and follow a crafted link supplied by the attacker - passive user interaction is mandatory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P) correctly characterises medium severity: the attack is network-accessible and requires no credentials, but passive victim interaction - following a crafted link - is a prerequisite that limits automated mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade J2Store to the first release above each affected range once the vendor publishes a patched build - check the vendor site at https://www.j2commerce.com/ for security release announcements targeting versions above 3.3.21, 4.0.21, and 4.1.6 respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in J2Store Extension For Joomla
View allMissing authorization in J2Store, the J2Commerce e-commerce extension for Joomla, lets remote attackers reach the `J2Sto
Cart-record tampering in J2Store (Joomla e-commerce extension by j2commerce.com) affects all versions across the 1.0.0-3
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20,
An arbitrary file read flaw in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0
Unauthenticated blind SQL injection in the J2Store e-commerce extension for Joomla allows remote attackers to extract ar
Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22
Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious sc
Cross-site request forgery in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–
Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, an
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today