CVE-2026-84438

Name of the Vulnerable Software and Affected Versions OpenCart versions 4.1.0.3 through 4.1.0.4

Description A cross site scripting issue exists in the Autocomplete Workflow component within the file catalog/controller/account/edit.php. A remote attacker can trigger this by manipulating the firstname argument. Cross site scripting is a technique where malicious scripts are injected into trusted websites.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the firstname argument in the affected component until the issue is resolved.