Skip to contentJ2commerce.com J2store Extension For Joomla vulnerabilities
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5CVE-2026-1028036.0 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7CVE-2026-821906.3 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7CVE-2026-780817.1 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7CVE-2026-815688.7 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7CVE-2026-821915.3 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7CVE-2026-815678.7 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7CVE-2026-821898.7 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5CVE-2026-780005.3 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6CVE-2026-780699.5 Critical
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6CVE-2026-780657.1 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6CVE-2026-779998.7 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6CVE-2026-780648.8 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5CVE-2026-673616.9 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5CVE-2026-74252Public exploit8.6 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5CVE-2026-67358Public exploit5.3 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5CVE-2026-673625.1 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5CVE-2026-673598.7 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5CVE-2026-673606.3 Medium