Login Request a demo
JE
Product
J2Store extension for Joomla
by j2commerce.com · last CVE Sep 15, 2026
17
CVEs
0
On KEV
9.5
Max CVSS
0
New 30D
Vulnerabilities17In the news0Timeline
Severity mix
Critical 1High 9Medium 7Low 0
Severity
All severities17Critical1High9Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add J2Store extension for Joomla to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-78069
9.5
0%
Sep 3
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Affected: 1.0.0-3.3.21; 4.0.0-4.0.21; 4.1.0-4.1.6
CVE-2026-78064
8.8
0%
Sep 3
Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Affected: 1.0.0-3.3.21; 4.0.0-4.0.21; 4.1.0-4.1.6
CVE-2026-81568
8.7
0%
Sep 15
Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Affected: 1.0.0-3.3.22; 4.0.0-4.0.22; 4.1.0-4.1.7
CVE-2026-81567
8.7
0%
Sep 15
Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Affected: 1.0.0-3.3.22; 4.0.0-4.0.22; 4.1.0-4.1.7
CVE-2026-82189
8.7
0%
Sep 15
Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Affected: 1.0.0-3.3.22; 4.0.0-4.0.22; 4.1.0-4.1.7
CVE-2026-77999
8.7
0%
Sep 3
Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Affected: 1.0.0-3.3.21; 4.0.0-4.0.21; 4.1.0-4.1.6
CVE-2026-67359
8.7
0%
Aug 21
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Affected: 1.0.0-3.3.20; 4.0.0-4.0.20; 4.1.0-4.1.5
CVE-2026-74252
8.6
1%
Aug 21
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Affected: 1.0.0-3.3.20; 4.0.0-4.0.20; 4.1.0-4.1.5
CVE-2026-78081
7.1
0%
Sep 15
Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Affected: 1.0.0-3.3.22; 4.0.0-4.0.22; 4.1.0-4.1.7
CVE-2026-78065
7.1
0%
Sep 3
Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Affected: 1.0.0-3.3.21; 4.0.0-4.0.21; 4.1.0-4.1.6
CVE-2026-67361
6.9
0%
Aug 21
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Affected: 1.0.0-3.3.20; 4.0.0-4.0.20; 4.1.0-4.1.5
CVE-2026-82190
6.3
0%
Sep 15
Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Affected: 1.0.0-3.3.22; 4.0.0-4.0.22; 4.1.0-4.1.7
CVE-2026-67360
6.3
0%
Aug 21
Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Affected: 1.0.0-3.3.20; 4.0.0-4.0.20; 4.1.0-4.1.5
CVE-2026-82191
5.3
0%
Sep 15
Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Affected: 1.0.0-3.3.22; 4.0.0-4.0.22; 4.1.0-4.1.7
CVE-2026-78000
5.3
1%
Sep 3
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Affected: 1.0.0-3.3.21; 4.0.0-4.0.21; 4.1.0-4.1.6
CVE-2026-67358
5.3
0%
Aug 21
Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Affected: 1.0.0-3.3.20; 4.0.0-4.0.20; 4.1.0-4.1.5
CVE-2026-67362
5.1
1%
Aug 21
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Affected: 1.0.0-3.3.20; 4.0.0-4.0.20; 4.1.0-4.1.5
Showing 17