The J2Store extension for Joomla is vulnerable to stored cross-site scripting (CWE-79) in multiple versions ranging from 1.0.0 through 4.1.5. The vulnerability arises from improper neutralization of input during web page generation, specifically in the guest checkout billing address fields. An unauthenticated attacker can exploit a filter bypass in Joomla's Input::getArray() function combined with PHP's variables_order=EGPCS configuration, where cookies override POST data in $_REQUEST, allowing storage of malicious HTML payloads in fields like billing_first_name. This can lead to persistent XSS attacks when the stored data is rendered in the application.

Successful exploitation allows an unauthenticated attacker to inject and store malicious HTML/JavaScript in billing address fields during guest checkout, which can be executed in the context of other users viewing the affected pages. This can lead to theft of session tokens, defacement, or other malicious actions with high impact on confidentiality and integrity. The CVSS 4.0 score is 8.6 (high severity), reflecting network attack vector, no privileges required, user interaction required, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider applying input validation or sanitization controls on billing address fields and review PHP configuration for variables_order to mitigate the filter bypass. Monitor vendor channels for updates and apply official patches once released.