{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/j2commerce/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-74252"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["J2Commerce"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","j2commerce"],"_cs_type":"advisory","_cs_vendors":["J2Commerce"],"content_html":"\u003cp\u003eJ2Commerce (com_j2store) versions 4.1.5 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-74252) within the guest checkout billing address fields. The vulnerability is caused by a filter bypass in Joomla's \u003ccode\u003eInput::getArray()\u003c/code\u003e method, which can be exploited when PHP's \u003ccode\u003evariables_order\u003c/code\u003e configuration defaults to 'EGPCS' (Cookie overrides POST in \u003ccode\u003e$_REQUEST\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003eAn unauthenticated attacker can submit a malicious payload in cookie fields that are then stored unsanitized in the \u003ccode\u003ej2store_orderinfos\u003c/code\u003e database table. Because the J2Commerce administrator order management panel fails to encode these fields when rendering the orders list, the payload executes automatically in the administrator's browser as soon as the orders listing page is loaded. This allows for session hijacking, unauthorized creation of administrator accounts, or the installation of malicious plugins to achieve further system compromise. The vulnerability affects any hosting environment where cookies take precedence over POST data in \u003ccode\u003e$_REQUEST\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a GET request to the J2Commerce frontend to obtain a CSRF token.\u003c/li\u003e\n\u003cli\u003eAttacker adds an item to the cart using \u003ccode\u003eoption=com_j2store\u0026amp;view=carts\u0026amp;task=addItem\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker submits a POST request to \u003ccode\u003eguest_validate\u003c/code\u003e containing both a POST parameter \u003ccode\u003efirst_name=RAW\u003c/code\u003e to trigger the filter bypass and a Cookie \u003ccode\u003efirst_name\u003c/code\u003e containing the XSS payload.\u003c/li\u003e\n\u003cli\u003eAttacker completes the shipping validation step to set the necessary session data.\u003c/li\u003e\n\u003cli\u003eAttacker completes the payment selection step.\u003c/li\u003e\n\u003cli\u003eAttacker finalizes the order via \u003ccode\u003econfirmPayment\u003c/code\u003e, which causes the backend to store the unsanitized XSS payload in the database.\u003c/li\u003e\n\u003cli\u003eAdministrator accesses the J2Commerce orders management interface.\u003c/li\u003e\n\u003cli\u003eThe XSS payload executes automatically in the administrator's browser context, potentially leading to account takeover or webshell deployment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full site compromise. An attacker can hijack administrative sessions, create new super-administrator accounts, or install malicious plugins to execute arbitrary PHP code on the server. Because the payload triggers automatically upon viewing the orders list, it requires no user interaction beyond the administrator's routine order management, and it persists until the malicious order record is removed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate J2Commerce (com_j2store) to version 4.1.6 or later to apply the necessary output encoding.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests to \u003ccode\u003ecom_j2store\u003c/code\u003e checkout endpoints containing non-standard Cookie headers.\u003c/li\u003e\n\u003cli\u003eReview J2Commerce orders database for suspicious values in the \u003ccode\u003ebilling_first_name\u003c/code\u003e, \u003ccode\u003ebilling_last_name\u003c/code\u003e, or address fields.\u003c/li\u003e\n\u003cli\u003eConfigure PHP \u003ccode\u003erequest_order\u003c/code\u003e to exclude cookies (e.g., \u003ccode\u003erequest_order = \u0026quot;GP\u0026quot;\u003c/code\u003e) if possible to prevent cookie-based override of input parameters, though this is a defense-in-depth measure.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-22T05:42:44Z","date_published":"2026-08-22T05:42:44Z","id":"https://feed.craftedsignal.io/briefs/2026-08-j2commerce-xss/","summary":"J2Commerce versions 4.1.5 and earlier are vulnerable to stored XSS via guest checkout, allowing unauthenticated attackers to execute malicious JavaScript in the administrator's browser upon order review.","title":"Stored XSS in J2Commerce via Guest Checkout Filter Bypass","url":"https://feed.craftedsignal.io/briefs/2026-08-j2commerce-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - J2commerce","version":"https://jsonfeed.org/version/1.1"}