JoomShopping: XSS Vulnerability — Update to Version 5.9.4

A reflected cross-site scripting vulnerability has been discovered in the JoomShopping component. It allows an attacker to inject JavaScript code into a specially crafted link to a product page.

The vulnerability has been assigned the identifier CVE-2026-63264 and a score of 5.3 on the CVSS 4.0 scale, corresponding to a medium severity level. The issue affects JoomShopping versions from 3.5.0 through 5.9.2.

The security fix was introduced in version 5.9.3. At the time of publication, the latest release is JoomShopping 5.9.4, so store owners are advised to update directly to this version or later.

Understanding the threat: reflected XSS in JoomShopping

The vulnerability is located in the frontend controller for product pages. One of the request parameters was not handled securely enough, allowing an attacker-controlled value to be inserted into the page's HTML without proper sanitisation and escaping.

This type of issue is known as reflected cross-site scripting, or Reflected XSS. The malicious code is not necessarily stored in the shop's database: it is included in the link itself, then “reflected” in the website's response and executed by the user's browser.

How could an attack work?

1. The attacker creates a link to a JoomShopping product page containing a specially crafted parameter.
2. The link is sent to a user by email, messenger, or social media, or is placed on a third-party website.
3. The user follows the link because they trust the familiar online store's domain.
4. The vulnerable version of JoomShopping displays the supplied data without sufficient filtering.
5. Malicious JavaScript code runs in the visitor's browser within the context of the store's domain.

What could exploitation lead to?

The consequences depend on who opens the malicious link and what data is accessible to their browser. An attack could potentially be used to:

• alter the content displayed on the store page;
• display a fake login or payment form;
• redirect the visitor to a fraudulent website;
• access data available to JavaScript in the browser;
• perform actions on behalf of an authenticated user;
• target an administrator if they follow the crafted link while signed in to Joomla.

Who is at risk?

Websites running JoomShopping versions from 3.5.0 through 5.9.2 are vulnerable. This includes online stores still operating on older Joomla versions.

The first fixed release is JoomShopping 5.9.3. However, version 5.9.4, which includes an additional bug fix, has since been released. You should therefore install version 5.9.4 or the latest available release.

The current JoomShopping branch is compatible with Joomla 4, Joomla 5, and Joomla 6. Before updating an older store, separately verify the compatibility of its template, payment plugins, shipping methods, and commercial add-ons.

How to resolve the problem: step-by-step instructions

Step 1: check the installed version

1. Open the Joomla Administrator interface.
2. Go to System → Manage → Extensions.
3. Enter JoomShopping or com_jshopping in the search field.
4. Check the installed component version.

If version 5.9.2 or earlier is installed, the website must be updated.

Step 2: create a complete backup

Before updating, back up the website's files and database. The backup should be stored outside the production server and remain available for restoration even if the website stops working.

For an online store, it is especially important to ensure that the backup includes:

• JoomShopping product, order, customer, and configuration tables;
• product images;
• payment and shipping plugins;
• the JoomShopping template and its overrides;
• commercial add-ons and their settings.

Step 3: update JoomShopping

1. Go to System → Update → Extensions.
2. Click the button to check for updates.
3. Locate JoomShopping and install version 5.9.4 or later.
4. After the update is complete, check the version number again in the list of installed extensions.

Step 4: update related extensions

JoomShopping is often used with separate add-ons. After updating the main component, check for current versions of:

• payment plugins;
• shipping plugins;
• cart, wishlist, filtering, and search modules;
• product import and export tools;
• invoice and printable document generators;
• SEO and routing plugins;
• the online store template and its overrides.

Updating only com_jshopping does not fix vulnerabilities that may exist in third-party add-ons.

Step 5: clear the cache and test the store

After installing the update, clear the Joomla cache, server-side cache, and CDN cache, if applicable. Then make sure to test:

1. category and product pages;
2. the selection of product characteristics and attributes;
3. adding products to the cart, changing their quantity, and removing them;
4. registration and guest checkout;
5. coupon application and discount calculations;
6. shipping and tax calculations;
7. redirection to the payment gateway and the return to your website;
8. emails sent to the customer and administrator;
9. order display in the Administrator interface.

Should you look for signs of compromise?

Reflected XSS does not usually leave malicious code in a website's database or files. Therefore, the mere fact that a store was running JoomShopping 5.9.2 or earlier does not mean it has been compromised.

Nevertheless, after updating, we recommend that you:

1. Review access logs: look for unusual requests to product pages containing long encoded parameters, HTML tags, or JavaScript constructs.
2. Check administrator accounts: make sure no unknown accounts or users with elevated privileges have appeared in Joomla.
3. Review store changes: check payment methods, notification recipient addresses, email templates, and recently modified content.
4. Inspect the files: pay attention to recently modified PHP files and unfamiliar scripts in the website's directories.
5. Review customer complaints: reports of redirects, fake forms, or unusual store behaviour may indicate an exploitation attempt.

Another known vulnerability in older versions

CVE-2025-22211 was previously published for JoomShopping. It is an SQL injection vulnerability in the backend country management section. According to the updated information, it affects the very old versions 1.0.0 through 1.4.3 and requires administrator privileges to exploit.

For modern stores, CVE-2026-63264 is the main current threat. However, the existence of older CVEs is another reminder of why an online store should not be left without updates for years.

Additional JoomShopping security measures

• Keep Joomla, JoomShopping, and PHP up to date.
• Remove unused add-ons instead of merely disabling them.
• Enable multi-factor authentication for all administrators.
• Do not open administrator links from suspicious emails in a browser with an active Joomla session.
• Restrict store manager permissions to the actions they actually need.
• Regularly review logs, users, and file changes.
• Create automatic backups and store them outside the shop's server.

We can take care of everything for you

If you are unsure about add-on compatibility or are concerned that the update may disrupt your store, our specialists can help you:

• create backup and test copies of the website;
• update Joomla, JoomShopping, and related extensions;
• check the template and its overrides;
• test the cart, checkout, shipping, and payment processes;
• scan the website for malicious code and unauthorised changes;
• strengthen the security of the Administrator interface.

Submit a request List of services