Joomla Extension - j2commerce.com - Reflected XSS via filtertag, pricefrom and priceto in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.

Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - editAddress() redirected non-owners away only when the loaded address row had a non-empty userid belonging to someone else. Guest-checkout address rows have an empty userid, so that check never triggered for them — any logged-in account guessing a small, sequential addressid got a guest customer's full name, street address, and phone number rendered prefilled into the edit form.

Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF save task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - fof.xml grants the carts view's tasks a wildcard true ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end format=raw requests. J2StoreControllerCarts already scoped remove() to the caller's own session, but never overrode the generic FOF save task, so it remained reachable to insert new cart rows with an attacker-chosen userid/sessionid, or overwrite an existing row by id.