CVE-2026-74252

Name of the Vulnerable Software and Affected Versions J2Store versions 1.0.0 through 3.3.20 J2Store versions 4.0.0 through 4.0.20 J2Store versions 4.1.0 through 4.1.5

Description Stored Cross-Site Scripting (XSS) exists in the guest checkout billing address fields. An unauthenticated attacker can store unsanitized HTML in fields such as billing first name by exploiting a filter bypass in the Input::getArray() function combined with the PHP variables order=EGPCS configuration, where cookies override POST data in the $ REQUEST superglobal.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.