Vulnerability · Published Apr 9, 2026 · Assigned by VulnCheck

CVE-2023-54364Joomla HikaShop 4.7.4 Reflected XSS via Product Filter

Medium 6.1

In plain English

A medium-severity cross-site scripting in Joomla HikaShop from Hikashop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 85.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the from_option, from_ctrl, from_task, or from_itemid parameters to steal session tokens or login credentials when victims visit the link.

Affected products (as reported)

Vendor	Product	Versions
Hikashop	Joomla HikaShop	4.7.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

ExploitDB-51629 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: Joomla HikaShop 4.7.4 Reflected XSS via Product Filter third-party-advisory