CVE-2026-84438: Cross Site Scripting in OpenCart

CVE-2026-84438 is a cross-site scripting vulnerability affecting OpenCart versions 4.1.0.3 and 4.1.0.4. The flaw exists in an unknown function within the catalog/controller/account/edit.php file, part of the Autocomplete Workflow component. By manipulating the 'firstname' parameter, an attacker can inject malicious scripts that execute in the context of the victim's browser. The vulnerability can be exploited remotely without requiring elevated privileges. The vendor was notified but has not provided a response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

Successful exploitation of this vulnerability allows an attacker to perform cross-site scripting attacks, potentially leading to session hijacking, defacement, or redirection to malicious sites. The impact is limited to the confidentiality and integrity of user interactions with the affected OpenCart installation. No direct impact on availability or system-level access is indicated. The medium severity reflects the moderate risk posed by this vulnerability given the need for user interaction and limited impact scope.

No official patch or remediation is currently available from the vendor, as they have not responded to the disclosure. Users of OpenCart versions 4.1.0.3 and 4.1.0.4 should consider implementing web application firewall (WAF) rules to detect and block XSS payloads targeting the 'firstname' parameter in the Autocomplete Workflow component. Additionally, applying input validation and output encoding on the affected parameter in custom deployments may reduce risk. Monitor vendor channels for any future updates or patches addressing this issue.