CVE-2026-84437: OpenCart Autocomplete Workflow address.php cross site scripting
A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which OpenCart versions are identified as affected?
The issue is reported in OpenCart 4.1.0.3 and 4.1.0.4. The affected code is in catalog/controller/account/address.php within the Autocomplete Workflow component.
What does an attacker need to exploit this issue?
The attack can be launched remotely, but the severity vector indicates the attacker needs low-level privileges and victim interaction. Exploitation involves manipulating the address_1 argument.
What is the security impact?
Successful exploitation can result in cross-site scripting and integrity impact. The supplied vector indicates no confidentiality or availability impact.
Is exploitation practical?
An exploit has been made public and could be used. The reported attack complexity is low.