J2Store extension for Joomla vulnerabilities | LiveThreat CVE Feed

Product

J2Store extension for Joomla

by j2commerce.com · last CVE Sep 15, 2026

CVEs

On KEV

9.5

Max CVSS

New 30D

Vulnerabilities17 In the news0 Timeline

Severity mix

Critical 1High 9Medium 7Low 0

Severity

All severities17 Critical1 High9 Medium7 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add J2Store extension for Joomla to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-78064	8.8	0%	Sep 3	Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 Affected: 1.0.0-3.3.21; 4.0.0-4.0.21; 4.1.0-4.1.6
CVE-2026-81568	8.7	0%	Sep 15	Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 Affected: 1.0.0-3.3.22; 4.0.0-4.0.22; 4.1.0-4.1.7
CVE-2026-81567	8.7	0%	Sep 15	Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 Affected: 1.0.0-3.3.22; 4.0.0-4.0.22; 4.1.0-4.1.7
CVE-2026-82189	8.7	0%	Sep 15	Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 Affected: 1.0.0-3.3.22; 4.0.0-4.0.22; 4.1.0-4.1.7
CVE-2026-77999	8.7	0%	Sep 3	Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 Affected: 1.0.0-3.3.21; 4.0.0-4.0.21; 4.1.0-4.1.6
CVE-2026-67359	8.7	0%	Aug 21	Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 Affected: 1.0.0-3.3.20; 4.0.0-4.0.20; 4.1.0-4.1.5
CVE-2026-74252	8.6	1%	Aug 21	Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 Affected: 1.0.0-3.3.20; 4.0.0-4.0.20; 4.1.0-4.1.5
CVE-2026-78081	7.1	0%	Sep 15	Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 Affected: 1.0.0-3.3.22; 4.0.0-4.0.22; 4.1.0-4.1.7
CVE-2026-78065	7.1	0%	Sep 3	Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 Affected: 1.0.0-3.3.21; 4.0.0-4.0.21; 4.1.0-4.1.6