CVE-2026-74252 Overview
CVE-2026-74252 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the J2Store/J2Commerce extension for Joomla. The flaw affects J2Store versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5. An unauthenticated attacker injects unsanitized HTML through the guest checkout billing address fields, such as billing_first_name. The payload persists in the store's database and executes when administrators or other users render the affected order data.
Critical Impact
Unauthenticated attackers can plant persistent JavaScript that executes in administrator sessions, enabling session theft, account takeover, and full compromise of the Joomla storefront.
Affected Products
- J2Store for Joomla 1.0.0 through 3.3.20
- J2Store for Joomla 4.0.0 through 4.0.20
- J2Commerce (J2Store) 4.1.0 through 4.1.5
Discovery Timeline
- 2026-08-21 - CVE-2026-74252 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-74252
Vulnerability Analysis
The vulnerability resides in the guest checkout flow of J2Commerce. When a customer submits billing address information, the extension retrieves the values through Joomla's Input::getArray() filter helper. The filter is bypassed, allowing raw HTML and script content to reach persistent storage in fields such as billing_first_name.
Because the malicious markup is stored and later rendered without contextual output encoding, the payload runs in the browser of any user who views the order, including administrators reviewing checkout data in the Joomla back end. This produces a stored XSS condition that requires no authentication to trigger.
Root Cause
Two issues combine to create the flaw. First, Input::getArray() in Joomla applies filters based on the caller's declared type map. Second, PHP's variables_order = EGPCS populates $_REQUEST such that cookie values override POST values with the same name. An attacker sets a cookie that shadows the sanitized POST field, and the unfiltered cookie value passes through as trusted input, defeating the filter contract.
Attack Vector
An unauthenticated attacker browses to the guest checkout page, attaches a crafted cookie whose name matches a billing field (for example billing_first_name), and submits the checkout form. The cookie payload replaces the POST value inside $_REQUEST, bypasses filtering, and is written to the order record. When a store administrator opens the order in the Joomla dashboard, the injected script executes with administrator privileges in the same browser context.
See the J2Commerce corporate website for vendor advisories and update guidance.
Detection Methods for CVE-2026-74252
Indicators of Compromise
- Order records with billing address fields containing HTML tags such as <script>, <img onerror=, <svg, or event-handler attributes.
- Web server access logs showing checkout POST requests accompanied by Cookie: headers whose names match billing form fields (for example Cookie: billing_first_name=...).
- Administrator sessions issuing outbound requests to unfamiliar domains shortly after opening a guest order.
Detection Strategies
- Query the J2Store order tables for billing address columns matching regular expressions that detect HTML tags or JavaScript event handlers.
- Inspect HTTP request bodies and headers at the web application firewall for checkout submissions where cookie names collide with POST parameter names.
- Correlate stored payload writes with subsequent administrator page views to identify successful XSS execution.
Monitoring Recommendations
- Enable verbose access logging for /index.php?option=com_j2store checkout endpoints and retain cookie header data.
- Alert on Joomla administrator sessions triggering unusual outbound HTTP requests or Document Object Model (DOM) modifications.
- Baseline expected characters in billing name fields and flag records containing angle brackets, backticks, or URL-encoded script fragments.
How to Mitigate CVE-2026-74252
Immediate Actions Required
- Upgrade J2Store/J2Commerce to a version released after 4.1.5 that addresses the input filter bypass.
- Audit existing orders for stored payloads in billing and shipping address fields and sanitize or remove affected records.
- Rotate Joomla administrator credentials and invalidate active administrator sessions if compromise is suspected.
Patch Information
Refer to the J2Commerce corporate website for the fixed release addressing the guest checkout filter bypass. Apply the update to all Joomla instances running affected J2Store versions in the 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 ranges.
Workarounds
- Disable guest checkout until the patched version is installed, requiring authenticated customer accounts for order submission.
- Deploy a web application firewall rule that blocks HTTP requests containing cookies whose names match sensitive form fields such as billing_first_name, billing_last_name, or billing_email.
- Configure PHP with a variables_order value that removes C (cookies) from $_REQUEST population where the application design permits, reducing cookie-over-POST override risk.
# php.ini hardening - remove cookies from $_REQUEST population
variables_order = "EGPS"
request_order = "GP"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
