CVE-2026-74252: Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla's Input::getArray() combined with PHP's variablesorder=EGPCS (Cookie overrides POST in $REQUEST ) to store unsanitized HTML in fields such as billingfirstname.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it through guest checkout billing-address fields, so no account is required where guest checkout is available.
What configuration condition is required for exploitation?
The issue relies on Joomla's Input::getArray() filter bypass together with PHP configured with variables_order=EGPCS, where cookie values override POST values in $_REQUEST.
Which inputs are implicated?
Guest checkout billing address fields are affected; billing_first_name is specifically identified as a field where unsanitized HTML can be stored.