CyberRota Analysis
AI-GeneratedJ2Store versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 are vulnerable to reflected cross-site scripting (XSS) due to inadequate validation of user input in specific task handlers, allowing attackers to redirect users to malicious sites using a trusted domain. This vulnerability poses a medium risk as it can facilitate phishing attacks without requiring user authentication. Joomla site administrators and developers using affected J2Store versions should prioritize patching to mitigate potential exploitation.
Original NVD Description
Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.