CVE-2026-84438: Cross Site Scripting in OpenCart

This vulnerability in OpenCart 4.1.0.3 and 4.1.0.4 allows remote attackers to perform cross-site scripting via the 'firstname' parameter in the Autocomplete Workflow component located in catalog/controller/account/edit.php. The issue arises from improper sanitization of this input, enabling script injection. The vulnerability has been publicly disclosed, but no official vendor fix or patch has been released. The CVSS 3.1 base score is 5.1 (medium severity), indicating a moderate risk with network attack vector, low privileges required, and user interaction needed.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions within the affected OpenCart application. The vulnerability requires user interaction and low privileges, limiting but not negating its impact. No known active exploitation in the wild has been reported.

No official patch or fix is currently available from the vendor. Users should monitor the vendor's advisories for updates. In the meantime, applying input validation and output encoding on the 'firstname' parameter in the affected component may reduce risk. Consider restricting access or disabling the vulnerable functionality if feasible until a fix is released.