CVE-2026-78000: Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Q: Does exploitation require an authenticated Joomla or J2Store account?

No. The record states that no authentication is required.

Q: What must an attacker be able to provide to trigger the redirect behavior?

An attacker needs to supply a base64-encoded URL to one of the four affected task handlers. The handlers redirect to the supplied URL without validating its destination host, which can support phishing through the shop's trusted domain.

Q: Is the affected-version scope consistent in this record?

No. The title lists redirect-related ranges ending in 3.3.20, 4.0.20, and 4.1.5, while the description refers to reflected XSS and ranges ending in 3.3.21, 4.0.21, and 4.1.6. The supplied data does not resolve this discrepancy.

Q: Does the record provide a temporary mitigation for environments that cannot patch immediately?

No temporary mitigation or configuration workaround is provided in the supplied data.

Published Sep 3, 2026

Updated

Joomla Extension - j2commerce.com - Reflected XSS via filtertag, pricefrom and priceto in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.

Affected Software

2 affected components

J2Store J2Store>=1.0.0<=3.3.20, >=4.0.0<=4.0.20, >=4.1.0<=4.1.5

J2Store J2Store>=1.0.0<=3.3.21, >=4.0.0<=4.0.21, >=4.1.0<=4.1.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade j2commerce.com/J2Store to a version that resolves this vulnerability.
Fixed in 1.0.0-3.3.20
Upgrade
Upgrade j2commerce.com/J2Store to a version that resolves this vulnerability.
Fixed in 1.0.0-3.3.21
Upgrade
Upgrade j2commerce.com/J2Store to a version that resolves this vulnerability.
Fixed in 4.0.0-4.0.20
Upgrade
Upgrade j2commerce.com/J2Store to a version that resolves this vulnerability.
Fixed in 4.0.0-4.0.21
Upgrade
Upgrade j2commerce.com/J2Store to a version that resolves this vulnerability.
Fixed in 4.1.0-4.1.5
Upgrade
Upgrade j2commerce.com/J2Store to a version that resolves this vulnerability.
Fixed in 4.1.0-4.1.6

Event History

Sep 3, 2026

CVE Published

via MITRE·11:59 AM

Data Sourced

via MITRE·11:59 AM

DescriptionWeakness

Frequently Asked Questions

Does exploitation require an authenticated Joomla or J2Store account?

No. The record states that no authentication is required.

What must an attacker be able to provide to trigger the redirect behavior?

An attacker needs to supply a base64-encoded URL to one of the four affected task handlers. The handlers redirect to the supplied URL without validating its destination host, which can support phishing through the shop's trusted domain.

Is the affected-version scope consistent in this record?