Stored XSS Vulnerability in J2Store Product by J2Commerce
CVE-2026-74252

8.6HIGH

Key Information:

Vendor

J2commerce.com

Status
J2store Extension For Joomla
Vendor
CVE Published:
21 August 2026

What is CVE-2026-74252?

The J2Store product by J2Commerce contains a vulnerability allowing stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated attacker can exploit this issue by bypassing Joomla's filter in Input::getArray(), which leads to the unsanitized storage of HTML in fields like billing_first_name. This vulnerability can potentially enable attackers to execute arbitrary scripts that could compromise sensitive information from unsuspecting users.

Affected Version(s)

J2Store extension for Joomla 1.0.0-3.3.20

J2Store extension for Joomla 4.0.0-4.0.20

J2Store extension for Joomla 4.1.0-4.1.5

References

https://www.j2commerce.com/
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Toan Le
.