CVE-2024-40746

CVE-2024-40746: Extension - hikashop.com - Stored cross site scripting vulnerability in Hikashop component for Joomla < 5.1.1

Vendor Hikashop.com

Product HikaShop component for Joomla

Weakness CWE-79 · XSS

Published October 21, 2024

Last update March 20, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `description` parameter of any product. The `description `parameter is not sanitised in the backend.

Key dates

02Disclosure timeline

October 21, 2024 CVE published

March 20, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-40746 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-2832 Campcodes Online Shopping System offersmail.php cross site scripting CVE-2025-43731 CVE-2025-48918 Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071 CVE-2021-32858 esdoc-publish-html-plugin vulnerable to Cross-site Scripting CVE-2026-5451 Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode