Vulnerabilities

J2Store, a Joomla e-commerce extension from j2commerce.com, contains an unauthenticated flaw in its order-status handling: an attacker who can reach the storefront can send a crafted status-update request for any order without authenticating or supplying valid payment or transaction data. The impact is a denial of service against the order pipeline — pending orders can be mass-flipped to FAILED to disrupt revenue and force manual reprocessing, and already-fulfilled orders can be reverted to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The root cause maps to CWE-472 (trust of assumed-immutable web parameters) and CWE-602 (client-side/server-side enforcement mismatch) on the order-status update flow. Every released version is affected — 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7 — earning a CVSS 4.0 score of 8.7 (high), though with no integrity impact beyond order state. Exploitation status: no public PoC and no known in-the-wild attacks, but the flaw is trivially discoverable by anyone probing a Joomla store.

Do: Update J2Store to a release newer than the affected ranges — i.e., beyond 4.1.7 on the current line, or the latest available build for sites still on the 3.x/4.0.x branches — since all prior versions are vulnerable. Audit order history for unexplained FAILED transitions and reconcile order states against payment-gateway records before issuing any refunds or cancellations. Until patched, apply a WAF rule or rate limit to block and log unauthenticated requests hitting order-status update endpoints.

J2Store, a Joomla e-commerce extension from j2commerce.com, builds the on-disk path for purchased digital downloads in J2StoreModelOrderdownloads::getFilePath() by concatenating the configured attachment folder with the stored product_file_save_name, applying only JPath::clean() — which normalizes separators but does not reject ../ segments — and never verifying the resolved path stays inside the attachment folder. When a customer triggers a download via task=download for a product file whose saved name contains a ../ traversal sequence, the path resolves outside the attachment folder and the requester can download any file readable by the web server, such as configuration.php containing database credentials and the Joomla secret. The traversal string is most plausibly injected through the CSRF-forgeable admin product-file save actions, so an attacker needs no server compromise to plant it, and a valid token/pid pair can be obtained by simply purchasing the product. Affected deployments are Joomla sites running J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, or 4.1.0-4.1.7 that use the digital downloads feature. There is no public PoC, no known in-the-wild exploitation, and the CVE is not in CISA's KEV catalog.

Do: Upgrade J2Store to a build newer than the affected ranges (later than 3.3.2 on the 3.x branch, later than 4.0.22 on 4.0.x, or later than 4.1.7 on 4.1.x), which resolves and confines the download path to the attachment folder. Audit stored product_file_save_name values in the product-files table for ../ segments and review web server access logs for task=download requests containing traversal sequences. If configuration.php may have been read, rotate the database credentials and the Joomla secret and invalidate all active sessions.

J2Store, a widely used e-commerce extension for Joomla from j2commerce.com, contains an unauthenticated blind SQL injection flaw in the storefront product list, reachable on any public shop that exposes the standard product listing or product-tags filter. An attacker with no account can craft malicious filter/listing requests and use boolean- or time-based inference to slowly extract arbitrary database content, including customer records, order data, and stored credentials or tokens. All shops running J2Store versions 1.0.0-3.3.2, 4.0.0-4.0.22, or 4.1.0-4.1.7 are affected because the vulnerable endpoint sits on the public-facing storefront, requiring no authentication or user interaction. The issue is rated high severity (CVSS 4.0: 8.7) with high impact on confidentiality of the shop database. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported as of this analysis.

Do: Upgrade J2Store immediately to a release outside the affected ranges (later than 4.1.7, or a patched build of your current branch). Until patched, apply WAF rules that filter SQL metacharacters on the product-list and product-tags filter parameters, and verify that the database account used by Joomla has least-privilege access. Review web server and database logs for anomalous, repetitive or slow-responding requests to storefront product listing/filter URLs as signs of blind SQL injection probing, and rotate any credentials, tokens, or secrets stored in the database if compromise is suspected.

J2Store, a Joomla e-commerce extension from j2commerce.com, ships its cart, checkout, and myprofile controllers without CSRF token checks, so a forged cross-site request can ride a victim's active session and silently overwrite the billing or shipping address before order confirmation — potentially redirecting a paid order's goods to an attacker-controlled address — or tamper with a saved profile address via saveAddress(). The attack requires user interaction (the victim must encounter attacker-controlled content while logged in), but needs no privileges and executes with the victim's own session rights, so there is no cross-account data access. The flaw is rated high severity (CVSS 4.0: 7.1, primarily an integrity impact). Every release of the product is affected: 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7. No public proof of concept exists and no in-the-wild exploitation has been observed.

Do: Upgrade every J2Store installation to the latest available release, which is newer than the affected ranges (beyond 4.1.7, 4.0.22, and 3.3.2 respectively). As an interim mitigation, enforce SameSite=Lax or Strict on session cookies (the 'cookie_samesite' setting on Joomla 4+) to blunt cross-site forgeries, and review recent orders for shipping or billing address changes made late in checkout that differ from the customer's saved profile.

SP Page Builder (Free and Pro) versions 4.0.0 through 6.9.0 suffer a path traversal flaw (CWE-22) in the media rename task: unlike the folder operations in the same controller, it applied no directory boundary checks, and its validation only required that a media record exist for the supplied identifier OR that the supplied path exist in the #__spmedia table rather than both, so the identifier and the filesystem path were never checked against each other while the STR input filter left traversal sequences intact. An authenticated attacker with high privileges (CVSS 4.0 base score 7.0, AV:N/PR:H) can pair any valid media identifier with an unrelated path and rename arbitrary files elsewhere in the Joomla installation — including renaming configuration.php to take the site offline. Affected deployments are Joomla sites running SP Page Builder 4.0.0–6.9.0 in either the Free or Pro edition. No public proof of concept is known, the CVE is not on the CISA KEV list, and no exploitation in the wild has been reported.

Do: Upgrade SP Page Builder (Free and Pro) to a release newer than 6.9.0, ideally the latest version available from joomshaper.com. Until patched, restrict access to the SP Page Builder media manager to trusted administrators only, since exploitation requires high privileges. Check the #__spmedia table, server access logs, and the Joomla root directory for evidence of rename operations targeting files outside the media folder — especially a missing or renamed configuration.php.

The content plugin shipped with JoomShaper SP Page Builder (Free and Pro) versions 5.2.1 through 6.9.0 contains an authenticated SQL injection in plgContentSppagebuilder::onContentAfterSave(): the jform[attribs][sppagebuilder_article_id] value from the request is concatenated directly into a WHERE view_id = ... clause querying #__sppagebuilder, with no quoting or type casting. Because Joomla's ARRAY input filter returns the array with element values untouched, the entire payload can be delivered in a single POST field, and because the vulnerable block executes before the com_content.article context test, it runs on every onContentAfterSave event regardless of which component triggered the save. An authenticated user with privileges sufficient to trigger a content save (CVSS 4.0: 8.6 high, PR:H) can exploit this as time-based blind SQL injection to read arbitrary database contents, including the #__users and #__session tables, enabling credential-hash and session-token theft and full site compromise. Any Joomla site running SP Page Builder Free or Pro 5.2.1–6.9.0 with the content plugin enabled is affected, including sites that received the extension bundled with JoomShaper templates. No public proof-of-concept exists, no exploitation in the wild has been reported, and the flaw is not on the CISA KEV list.

Do: Update SP Page Builder (Free and Pro) to the latest release, which is newer than 6.9.0 and contains the fix. If patching must be deferred, disable the SP Page Builder content plugin (plgContentSppagebuilder) where it is not needed and restrict content-authoring privileges (Author level and above) to fully trusted users, since exploitation requires an authenticated, privileged trigger. Review logs for POST requests carrying jform[attribs][sppagebuilder_article_id] with non-numeric or oversized values, and audit #__users and #__session for signs of extraction such as unexpected administrator accounts or hijacked sessions.

Regular Labs Modals Pro for Joomla, in all versions before 17.0.0, contains a privileged stored cross-site scripting (XSS) flaw because its documented JavaScript event-handler feature (such as on-open and on-closed) is not restricted to trusted extension configuration. An authenticated attacker holding only author-level privileges can embed executable event code in ordinary article content, and that script then runs in the browser of any user — including a site administrator — who views the page. Successful exploitation gives the attacker script execution in a higher-privileged user's session, which can be leveraged for administrative actions such as content tampering, further account compromise, or site takeover. Sites running Modals Pro below 17.0.0 that allow non-trusted users to author articles are the most exposed; only the third-party extension is affected, not Joomla core. There is no evidence of exploitation in the wild, no public proof of concept, and the CVE is not on CISA's Known Exploited Vulnerabilities catalog.

Do: Upgrade Modals Pro to version 17.0.0 or later, where the event-handler feature is reserved for trusted extension configuration. Until then, restrict article authoring to fully trusted staff and review existing articles for {modal} tags containing on-open/on-closed or other event attributes from untrusted contributors. Also audit author-level user accounts for suspicious or unauthorized registrations, since the flaw requires an authenticated author account to exploit.

Regular Labs Snippets for Joomla contains a stored cross-site scripting (XSS) flaw in how the extension substitutes variable values supplied through article tags into saved Snippet content. Because affected versions do not check the article author's trust level, a lower-privileged author can inject an unsafe value — for example via the url option — into a security-sensitive position in content designed by a trusted Snippet author. Successful exploitation causes the attacker's script to execute in the browsers of site visitors or higher-privileged users such as administrators, enabling cookie/session theft or malicious actions taken as the victim. The affected products are Snippets Free for Joomla before 7.0.0 and Snippets Pro for Joomla before 11.0.0, rated high severity (CVSS 4.0: 7.5) with the attack requiring attacker preparation and author-level privileges. The flaw is not in CISA's KEV catalog, and no public proof of concept or observed in-the-wild exploitation is known.

Do: Upgrade Snippets Free to version 7.0.0 or later, and Snippets Pro to version 11.0.0 or later. Audit articles authored by low-privilege users for Snippet tags containing unexpected url or variable values, and review site logs for injected script payloads. Until patched, consider restricting authoring permissions or Snippet usage to trusted users only.

Articles Anywhere, a Joomla content plugin from Regular Labs (regularlabs.com), contains a privileged stored cross-site scripting flaw (CVSS v4.0 7.5) in versions before 20.0.0: it accepts link options such as onclick and onmouseover and renders them as real HTML event attributes without checking the article author's trust level. An attacker with at least Joomla Author-level permissions can embed these options in the plugin's tag inside an article, and the malicious syntax survives Joomla's normal Author content filter because the executable HTML is only generated later, when the page is rendered. When a victim — potentially an administrator viewing the article in the backend — loads the affected page, the injected event handler executes attacker-controlled JavaScript in their session, enabling session or cookie theft and full site takeover (high confidentiality and integrity impact). Affected deployments are Joomla sites running Articles Anywhere before 20.0.0, especially those that let untrusted or semi-trusted users author content that the plugin processes. No public proof of concept is known, the CVE is not on CISA's KEV list, and there is no evidence of in-the-wild exploitation to date.

Do: Upgrade Articles Anywhere to version 20.0.0 or later immediately. If upgrading is delayed, restrict the plugin so it does not process content from low-trust author groups, and do not rely on Joomla's built-in Author content filter, since the plugin syntax bypasses it. Audit existing articles for Articles Anywhere plugin tags carrying link options with event-handler attributes (e.g., onclick, onmouseover) and review user accounts and logs for signs of injected payloads or session abuse.

Conditional Content and Conditional Content Pro, Joomla extensions from Regular Labs, in versions before 8.0.0 accept inline PHP inside Condition Rules article syntax and pass it to their conditions evaluator without checking who authored the article. Because Joomla's normal Author text filter preserves the syntax, any authenticated user with article-authoring rights can embed PHP that runs as the web-server process as soon as the article is published and rendered. This effectively lets an author-level account escalate to full server-side code execution, reflected in a CVSS 4.0 score of 9.4 (critical) with a network attack vector and high privileges required. Sites running Conditional Content or Conditional Content Pro below 8.0.0 are affected. No public proof of concept is known, the issue is not on the CISA KEV list, and there is no evidence of exploitation in the wild.

Do: Upgrade Conditional Content and Conditional Content Pro to version 8.0.0 or later immediately. Until patched, restrict article-authoring rights to trusted users only, and review existing articles' Conditional Content rules for unexpected inline PHP. Audit author accounts and recently published articles for signs of injected code, since any author could have achieved code execution as the web-server user.

Tabs & Accordions, a Joomla extension from Regular Labs (regularlabs.com), contains a stored cross-site scripting (XSS) flaw in all versions before 3.1.0: the extension rewrites links matching an item alias into calls to its browser API and places that alias inside a quoted JavaScript argument within an HTML onclick attribute, without escaping either the JavaScript-string or the HTML-attribute context. An attacker with the privileged access needed to set the rtla-alias option (for example, a backend user permitted to edit the extension's items or relevant content) can supply a crafted data-rlta-alias value that alters the generated click handler and executes attacker-controlled JavaScript. Because the payload is stored and fires with no victim interaction, it can target higher-privileged users such as site administrators, enabling session theft and full site takeover (CVSS 4.0: 7.5, high). Affected deployments are Joomla sites running Tabs & Accordions earlier than 3.1.0, particularly those where semi-trusted users hold content- or extension-editing rights. The flaw is not in CISA's KEV catalog, and no public proof of concept or observed in-the-wild exploitation is known.

Do: Upgrade Tabs & Accordions to version 3.1.0 or later, which remediates the flaw. Audit existing articles and extension items for suspicious data-rlta-alias values or unexpected onclick handlers, and restrict which backend accounts are allowed to edit those items. If tampering is found, remove the injected content and reset administrator sessions and credentials.

Quick Index, a table-of-contents extension for Joomla from Regular Labs, fails to escape the configurable class option before inserting it into a generated HTML attribute in versions before 5.0.5. A user with high privileges, such as a trusted author or editor who can enter plugin syntax, can craft a class value that closes the intended attribute and injects a new attribute (for example an event handler), which then executes in the browsers of site visitors or other users viewing the page. Joomla's built-in content filtering cannot reliably block this because Quick Index constructs the executable HTML after the authored plugin syntax has already passed through the filter. The flaw is rated high severity (CVSS 4.0: 7.5) but requires an authenticated, privileged account, so it is most dangerous on sites where content authors are not fully trusted. No public proof of concept is known, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been reported.

Do: Upgrade Quick Index to version 5.0.5 or later, which escapes class values before HTML generation. Until patched, restrict which Joomla user groups can create content or enter plugin syntax, and review existing Quick Index plugin tags for class values containing quotes, angle brackets, or 'on'-prefixed event names that could break out of the attribute. Also inspect rendered pages and server logs for suspicious injected attributes or anomalous session activity from privileged accounts.

Regular Labs' Modals extension for Joomla, in all versions before 17.0.0, treats a modal destination that uses an executable browser URL scheme (such as javascript:) as an ordinary modal URL. A user with high authoring privileges can store such a destination in content, and the value flows unchecked into both the generated link and the iframe-loading path. When a visitor views the content or opens the modal, the stored value can execute as JavaScript in that visitor's browser — bypassing Modals' separate, gated Pro JavaScript Events feature — enabling session/cookie theft or actions in the victim's context, up to administrator account takeover. Any Joomla site running Modals below 17.0.0 is affected, with practical risk concentrated on sites where semi-trusted users hold authoring or editing permissions. No public proof of concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild is known.

Do: Update Modals to version 17.0.0 or later on all Joomla sites as soon as possible. Audit existing articles and modal destinations for executable URL schemes (e.g., javascript:, data:, vbscript:) and remove or sanitize any found. Restrict authoring and editing privileges to trusted users, since exploitation requires high privileges to plant the stored payload.

SP Property, a real-estate listing extension for Joomla by JoomShaper, fails to contextually escape attributes and text values when rendering multiple frontend view templates and administrator list tables, allowing unauthenticated attackers to inject script that later executes in victims' browsers. An attacker submits crafted content that is stored and then rendered directly into HTML without escaping; when a user, including a site administrator reviewing listings in the back end, loads an affected page, the injected JavaScript runs in that user's session. Successful exploitation can lead to cookie/session theft, unauthorized actions performed with the victim's privileges, and potentially broader site compromise if an administrator triggers the payload. Any Joomla installation running SP Property prior to version 4.1.4 is affected. As of now the flaw is not on CISA KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known.

Do: Upgrade SP Property to version 4.1.4 or later, which adds contextual escaping in the affected frontend views and administrator list tables. Until upgraded, restrict unauthenticated submission of listing-related data where feasible and review stored listing fields for injected HTML or JavaScript. Administrators should monitor for suspicious sessions or unexpected admin-account changes, since back-end list pages are among the unescaped render paths.

SP Property, a real-estate listing component for Joomla from JoomShaper, versions before 4.1.4, processed POST requests on its visitor booking (properties.booking) and agent contact form (agents.sendmail) endpoints without verifying Joomla session anti-CSRF tokens (CWE-352). An attacker can host a page or link that induces a visitor's or logged-in user's browser to silently submit forged POST requests to these endpoints; because no token check is performed, the requests are accepted regardless of origin. The practical impact is rated high for integrity: an attacker can inject fraudulent booking submissions or trigger contact/email sends through the site's mail (e.g., spam or spoofed messages to agents), though no confidentiality impact is expected. Any Joomla site running SP Property prior to 4.1.4 is affected. There is currently no known exploitation, no public proof-of-concept, and the issue is not in CISA's KEV; a fix was released in SP Property 4.1.4.

Do: Upgrade SP Property to 4.1.4 or later, available from JoomShaper. Until updated, there is no built-in configuration mitigation, so review site logs for unexpected or forged POST submissions to the properties.booking and agents.sendmail endpoints and consider WAF rules or Joomla's CAPTCHA/token-hardening options as partial mitigations.

SP Property, a real-estate listing extension for Joomla from JoomShaper, contains an unauthenticated SQL injection (CWE-89) in the query builders for its property search and map-filtering features. Search and filter parameters such as zipcode, sorting, price_range_dropdown, and psize_range_dropdown are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, so crafted requests to the search or map endpoints execute attacker-controlled SQL. A remote attacker with no credentials can exploit this via boolean-based or time-based blind SQL injection to extract sensitive data from the Joomla site's database. Any Joomla site running SP Property versions prior to 4.1.4 that exposes the property search or map filtering to visitors is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is not listed in CISA's KEV catalog.

Do: Upgrade SP Property to version 4.1.4 or later. Sites that cannot upgrade immediately should restrict or filter requests to the property search and map-filtering endpoints (the zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters, e.g. via WAF rules) and review web and database logs for slow or anomalous queries consistent with blind SQL injection. Verify the installed version in the Joomla extensions manager.