CVE-2026-78000: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in j2commerce.com J2Store extension for Joomla

CVE-2026-78000 is a reflected cross-site scripting vulnerability (CWE-79) in the J2Store extension for Joomla. It affects versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6. The vulnerability arises because certain parameters (filter_tag, pricefrom, priceto) are not properly sanitized during web page generation, allowing injection of malicious scripts. Furthermore, four task handlers accept a base64-encoded URL from user input and redirect to it without validating the destination host, which can be abused for phishing attacks leveraging the trusted domain of the shop. Exploitation does not require authentication.

Successful exploitation can lead to reflected XSS attacks, allowing attackers to execute arbitrary scripts in the context of the affected site. This can result in session hijacking, defacement, or redirection to malicious sites. The open redirect component enables phishing attacks by redirecting users to attacker-controlled destinations while appearing to originate from the trusted shop domain. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, no privileges required, user interaction needed, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, users should consider disabling or restricting access to vulnerable parameters and handlers if possible, and monitor for suspicious activity related to redirects. Avoid relying solely on the shop's domain for trust in links. Follow vendor updates closely for any released patches or official mitigations.