Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Vendors
J2commercecom

j2commerce.com Vulnerabilities: CVEs, CISA KEV & Security Advisories

17 CVEs

JC

j2commerce.com Vulnerabilities

CVE security advisories and vulnerability history for j2commerce.com.

17

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

7.4

Avg CVSS

2026–2026

Overview

j2commerce.com has 17 published CVE records since 2026, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 7.4.

Security scorecard

A quick read on j2commerce.com's vulnerability posture, as a share of its 17 published CVEs.

Average CVSS: 7.4
Critical / high: 59%
Actively exploited (KEV): 0%
Public exploit available: 0%
Patch available: 0%

Severity and exploitation

How the CVSS severity of j2commerce.com's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High9

Medium7

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of j2commerce.com's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No j2commerce.com CVEs currently have a tracked public exploit.

Most affected products

The j2commerce.com products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

J2Store extension for Joomla17 CVEs

Common weakness types

The CWE weakness categories most often found in j2commerce.com CVEs. Follow any weakness for its full explanation.

CWE-639Authorization Bypass Through User-Controlled Key5 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2 CVEs
CWE-472External Control of Assumed-Immutable Web Parameter2 CVEs
CWE-1241Use of Predictable Algorithm in Random Number Generator2 CVEs
CWE-352Cross-Site Request Forgery (CSRF)2 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')1 CVE
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVE
CWE-601URL Redirection to Untrusted Site ('Open Redirect')1 CVE

CNAs that assign these CVEs

The CVE Numbering Authorities that publish j2commerce.com CVE records.

Joomla17 CVEs

Latest j2commerce.com CVEs

The most recently disclosed vulnerabilities affecting j2commerce.com.

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
CWE-1241
Medium · CVSS 6.3
EPSS 0.3%2026-09-15
Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
CWE-352
High · CVSS 7.1
EPSS 0.2%2026-09-15
Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
CWE-22
High · CVSS 8.7
EPSS 0.5%2026-09-15
Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
CWE-1241
Medium · CVSS 5.3
EPSS 0.4%2026-09-15
Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
CWE-89
High · CVSS 8.7
EPSS 0.4%2026-09-15
Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
CWE-472
High · CVSS 8.7
EPSS 0.4%2026-09-15
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
CWE-79
Medium · CVSS 5.3
EPSS 0.5%2026-09-03
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
CWE-862
Critical · CVSS 9.5
EPSS 0.4%2026-09-03
Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
CWE-639
High · CVSS 7.1
EPSS 0.4%2026-09-03
Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
CWE-472
High · CVSS 8.7
EPSS 0.4%2026-09-03
Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
CWE-639
High · CVSS 8.8
EPSS 0.4%2026-09-03
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
CWE-352
Medium · CVSS 6.9
EPSS 0.2%2026-08-21

Get an alert for each new j2commerce.com CVE, with AI-written analysis and remediation steps.

Monitor j2commerce.com CVEs

Other vendors

CVE counts for other vendors.

microsoft41,739 CVEs linux25,260 CVEs Google17,495 CVEs Apple15,495 CVEs Oracle13,348 CVEs Debian10,233 CVEs IBM9,452 CVEs Red Hat8,581 CVEs

Browse all vendors

Frequently asked questions

Common questions about j2commerce.com vulnerabilities.

How many CVEs does j2commerce.com have?: j2commerce.com has 17 published CVE records since 2026, including 17 in the last two years.
How many j2commerce.com CVEs are in CISA KEV?: None of j2commerce.com's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which j2commerce.com products have the most CVEs?: The j2commerce.com products with the most published CVEs are J2Store extension for Joomla.
What are the most common weakness types in j2commerce.com CVEs?: j2commerce.com's CVEs most often map to these CWE weakness types: CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-472 (External Control of Assumed-Immutable Web Parameter), CWE-1241 (Use of Predictable Algorithm in Random Number Generator).
Are there public exploits for j2commerce.com vulnerabilities?: No j2commerce.com CVEs currently have a tracked public exploit in this dataset.
How many critical j2commerce.com vulnerabilities are there?: j2commerce.com has 1 critical and 9 high-severity CVEs.
What is the average severity of j2commerce.com CVEs?: The average CVSS base score across j2commerce.com's scored CVEs is 7.4.

References

The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to
CNA directory: the CNAs that assign these CVEs

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track j2commerce.com vulnerabilities

Get an alert for each new j2commerce.com CVE, with AI-written analysis and remediation steps.

Create an account See pricing

On this page

Overview
Security scorecard
Severity and exploitation
Most affected products
Common weakness types
Assigning CNAs
Latest CVEs
Other vendors
FAQ
References