# CVE-2026-84437: OpenCart stored cross-site scripting in customer address

Source: https://junglewise.ai/threats/cve-2026-84437-opencart-stored-cross-site-scripting-in-customer-address  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84437 · Severity: low · CVSS 3.5 · Published 2026-09-02

OpenCart is a popular open-source e-commerce platform used by online retailers to manage product catalogs and customer orders. A vulnerability in the customer address handling allows an unauthenticated attacker or a regular customer to inject malicious HTML/JavaScript into address fields, which is later executed in an administrator's browser when they access the order management interface. An attacker could exploit this to steal admin session tokens, modify orders, or compromise customer data.

Technologies: [OpenCart](https://junglewise.ai/threats/technologies/opencart). Vendors: [OpenCart](https://junglewise.ai/threats/vendors/opencart).

## Quick answers

**Is CVE-2026-84437 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84437 being exploited in the wild.

**How severe is CVE-2026-84437?** Low severity, with a CVSS score of 3.5, published 2 September 2026.

**Which products and versions are affected?** OpenCart 4.1.0.3, 4.1.0.4.

**Is there a fix for CVE-2026-84437?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84437 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84437?** Check whether you run OpenCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in OpenCart 4.1.0.3 and 4.1.0.4, specifically in the customer address autocomplete workflow. A regular front-office customer can inject attacker-controlled HTML into the address_1 field via catalog/controller/account/address.php. The malicious payload is stored in the database and later returned by the backend autocomplete API (admin/controller/customer/customer.php). When an administrator opens the order creation/editing page, the admin interface decodes HTML entities and concatenates the stored address values directly into a select dropdown using raw HTML injection (admin/view/template/sale/order_info.twig), allowing the injected script to execute in the admin's browser. No special privileges or user interaction is required beyond a standard login. Patches are expected from the vendor, though early disclosure notifications went unanswered.

## Affected products

- OpenCart OpenCart 4.1.0.3, 4.1.0.4

## Timeline

- 2026-09-02: disclosed
- other: Exploit proof-of-concept published publicly

## References

- [https://github.com/Leousum/VulnPoC/blob/main/OpenCart_4.1.0.3/customer-address-stored-xss.md](https://github.com/Leousum/VulnPoC/blob/main/OpenCart_4.1.0.3/customer-address-stored-xss.md)
- [https://vuldb.com/cve/CVE-2026-84437](https://vuldb.com/cve/CVE-2026-84437)

## Related threats

- [OpenCart stored XSS in customer profile fields](https://junglewise.ai/threats/cve-2026-84438-opencart-stored-xss-in-customer-profile-fields)
- [OpenCart path traversal in extension installer](https://junglewise.ai/threats/cve-2026-18412-opencart-path-traversal-in-extension-installer)
- [Soft-Php jCart for OpenCart SQL injection in product_id](https://junglewise.ai/threats/cve-2017-20282-soft-php-jcart-for-opencart-sql-injection-in-product-id)
- [softPHP jCart for OpenCart CSRF in account management endpoints](https://junglewise.ai/threats/cve-2018-25336-softphp-jcart-for-opencart-csrf-in-account-management-endpoints)
- [OpenCart CSRF password change in account/password endpoint](https://junglewise.ai/threats/cve-2021-47953-opencart-csrf-password-change-in-account-password-endpoint)