Vulnerability · Published Aug 21, 2026 · Assigned by Joomla

CVE-2026-67362Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Medium 5.1

In plain English

A medium-severity open redirect in J2Store extension for Joomla from j2commerce.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.5%top 54.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.

Affected products (as reported)

Vendor	Product	Versions
j2commerce.com	J2Store extension for Joomla	1.0.0-3.3.204.0.0-4.0.204.1.0-4.1.5

Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://www.j2commerce.com/ product