CVE-2026-63264 MEDIUM

CVE-2026-63264: Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3

Vendor Joomshopping.com
Product JoomShopping extension for Joomla
Weakness CWE-79 · XSS
Published July 22, 2026
Last update July 23, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.

Explanation of Vulnerability in Simple Terms

02Summary

JoomShopping contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the site. An attacker can craft a malicious link or page that, when visited by a user, executes JavaScript in their browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability requires user interaction to exploit.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in users' browsers via crafted links or pages.

Potential impact on your site

04Site Impact

Visitors to your site could have their sessions hijacked, credentials stolen, or see malicious content injected into pages.

Conditions required to exploit

05Prerequisites

A user must visit an attacker-controlled or attacker-modified page containing the malicious payload.

Key dates

06Disclosure timeline

July 22, 2026 CVE published
July 23, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-12231 Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image' CVE-2026-65513 WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability CVE-2026-61961 WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-12801 Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes CVE-2026-5158 PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block