CVE-2026-84437: OpenCart XSS Vulnerability

CVE-2026-84437 Overview

CVE-2026-84437 is a stored cross-site scripting (XSS) vulnerability affecting OpenCart versions 4.1.0.3 and 4.1.0.4. The flaw resides in an unknown function within catalog/controller/account/address.php, part of the Autocomplete Workflow component. Attackers can manipulate the address_1 argument to inject malicious script content that persists in the application. Exploitation requires network access, low privileges, and user interaction with the tainted content. According to the public disclosure, the vendor was contacted but did not respond, and a proof of concept is publicly available.

Critical Impact
An authenticated attacker can inject persistent JavaScript into customer address fields, enabling session theft, phishing, or unauthorized actions against users who view the affected address data. [CWE-79]

Affected Products

OpenCart 4.1.0.3
OpenCart 4.1.0.4
Component: catalog/controller/account/address.php (Autocomplete Workflow)

Discovery Timeline

2026-09-02 - CVE-2026-84437 published to NVD
2026-09-02 - Last updated in NVD database
Public disclosure - Proof of concept published on GitHub PoC for OpenCart XSS

Technical Details for CVE-2026-84437

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw [CWE-79] in the OpenCart customer address workflow. The address_1 parameter submitted through the Autocomplete Workflow in catalog/controller/account/address.php is not properly sanitized or output-encoded. Injected payloads persist in the customer address record and execute in the browser of any user rendering the address data. Because the payload is stored server-side, exploitation does not require crafted per-request links and can affect administrators, staff, and other customers viewing address content.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation. The address controller accepts the address_1 field without enforcing an allowlist, HTML-encoding, or context-aware output escaping before persistence and rendering. Any HTML or JavaScript submitted in this field is preserved verbatim and later returned to browser contexts, producing script execution.

Attack Vector

Exploitation occurs over the network against an authenticated customer account. An attacker submits a crafted address_1 value through the account address form or the autocomplete endpoint. The malicious payload is stored against the account and later delivered to any user whose browser renders that address, including back-office operators. Impact is limited to integrity in the victim's browser context — including cookie access, page manipulation, and forced actions — with no direct confidentiality or availability loss to the server.

No verified exploit code is included here. Refer to the public proof of concept at the GitHub PoC for OpenCart XSS for technical details.

Detection Methods for CVE-2026-84437

Indicators of Compromise

Customer address records where address_1 contains HTML tags, <script> elements, or JavaScript URI schemes such as javascript:.
Outbound requests from staff or admin browsers to unfamiliar domains immediately after opening a customer address view.
Unexpected session token or cookie exfiltration events correlated with access to the OpenCart account address pages.

Detection Strategies

Inspect HTTP POST bodies to catalog/controller/account/address.php and autocomplete endpoints for payloads containing angle brackets, event handlers (onerror, onload), or encoded script markers.
Query the OpenCart database for stored address fields matching regular expressions for HTML or script content and flag records for review.
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts triggered by tainted address rendering.

Monitoring Recommendations

Enable web application firewall (WAF) logging on all OpenCart account and checkout endpoints and alert on XSS signature matches.
Monitor admin panel sessions for anomalous JavaScript-driven activity such as unauthorized order edits or user creation.
Track EPSS movement for CVE-2026-84437 and prioritize response if exploitation prevalence rises.

How to Mitigate CVE-2026-84437

Immediate Actions Required

Audit and sanitize existing customer address records in OpenCart 4.1.0.3 and 4.1.0.4 to remove HTML or script content from the address_1 field.
Apply strict server-side input validation on address fields, rejecting payloads containing HTML markup or scripting constructs.
Restrict administrative access to the customer address views until sanitization and output encoding are enforced.

Patch Information

No vendor patch is currently referenced in the CVE data. The public disclosure notes that the vendor was contacted early but did not respond. Monitor the VulDB CVE-2026-84437 Details entry and the official OpenCart release channels for a fixed version, and plan to upgrade as soon as a corrected build is published.

Workarounds

Add a WAF rule blocking requests to the account address endpoints whose address_1 parameter contains <, >, javascript:, or common event handler attributes.
Enforce a restrictive Content Security Policy that disallows inline scripts and untrusted script sources across the storefront and admin panel.
Apply HTML-encoding at every template location that renders address_1, ensuring context-appropriate escaping for HTML body, attribute, and JavaScript contexts.

bash

# Example ModSecurity rule to block script-like payloads in address_1
SecRule ARGS:address_1 "@rx (?i)(<script|javascript:|on\w+\s*=)" \
  "id:1008443,phase:2,deny,status:403,log,\
   msg:'CVE-2026-84437 OpenCart address_1 XSS attempt blocked'"