# J2commerce.com J2Store vulnerabilities

Source: https://junglewise.ai/threats/technologies/j2store  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/j2store.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 16 vulnerabilities in J2commerce.com J2Store: 0 in the last 7 days and 16 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-82191, was published on 15 September 2026. Nothing in the last four weeks, down from 6 vulnerabilities in the four before.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 16
- All time: 16 (0 critical, 0 exploited in the wild)

## About J2commerce.com J2Store

E-commerce shopping cart extension for Joomla.

## Latest J2commerce.com J2Store vulnerabilities

- [CVE-2026-82191: J2Store PayPal parameter injection in redirect](https://junglewise.ai/threats/cve-2026-82191-j2store-paypal-parameter-injection-in-redirect) (info, CVSS 2.7, published 15 Sep 2026)
- [CVE-2026-82190: J2Store predictable order access token](https://junglewise.ai/threats/cve-2026-82190-j2store-predictable-order-access-token) (info, CVSS 0, published 15 Sep 2026)
- [CVE-2026-82189: J2Store order status manipulation via unauthenticated request](https://junglewise.ai/threats/cve-2026-82189-j2store-order-status-manipulation-via-unauthenticated-request) (info, CVSS 7.5, published 15 Sep 2026)
- [CVE-2026-81568: J2Store arbitrary file read via path traversal in download handler](https://junglewise.ai/threats/cve-2026-81568-j2store-arbitrary-file-read-via-path-traversal-in-download) (info, CVSS 6.5, published 15 Sep 2026)
- [CVE-2026-81567: J2Store SQL injection in storefront product list](https://junglewise.ai/threats/cve-2026-81567-j2store-sql-injection-in-storefront-product-list) (info, CVSS 7.5, published 15 Sep 2026)
- [CVE-2026-78081: J2Commerce J2Store missing CSRF protection in checkout controllers](https://junglewise.ai/threats/cve-2026-78081-j2commerce-j2store-missing-csrf-protection-in-checkout) (info, published 15 Sep 2026)
- [CVE-2026-78069: J2Store missing authorization in Apps controller](https://junglewise.ai/threats/cve-2026-78069-j2store-missing-authorization-in-apps-controller) (info, published 3 Sep 2026)
- [CVE-2026-78065: J2Store guest checkout address disclosure via IDOR](https://junglewise.ai/threats/cve-2026-78065-j2store-guest-checkout-address-disclosure-via-idor) (info, CVSS 4.3, published 3 Sep 2026)
- [CVE-2026-78064: J2Store anonymous cart tampering via FOF save task](https://junglewise.ai/threats/cve-2026-78064-j2store-anonymous-cart-tampering-via-fof-save-task) (info, CVSS 7.5, published 3 Sep 2026)
- [CVE-2026-78000: J2Store reflected XSS via filter_tag, pricefrom, priceto parameters](https://junglewise.ai/threats/cve-2026-78000-j2store-reflected-xss-via-filter-tag-pricefrom-priceto-parameters) (info, published 3 Sep 2026)
- [CVE-2026-77999: J2Store PayPal IPN signature bypass and order confirmation fraud](https://junglewise.ai/threats/cve-2026-77999-j2store-paypal-ipn-signature-bypass-and-order-confirmation-fraud) (info, CVSS 9.1, published 3 Sep 2026)
- [CVE-2026-67362: J2Store open redirect in cart controller](https://junglewise.ai/threats/cve-2026-67362-j2store-open-redirect-in-cart-controller) (info, published 21 Aug 2026)
- [CVE-2026-67361: J2Store unauthenticated file upload with missing directory protection](https://junglewise.ai/threats/cve-2026-67361-j2store-unauthenticated-file-upload-with-missing-directory) (info, published 21 Aug 2026)
- [CVE-2026-67360: J2Store cross-customer order replication in cart checkout](https://junglewise.ai/threats/cve-2026-67360-j2store-cross-customer-order-replication-in-cart-checkout) (info, CVSS 5.7, published 21 Aug 2026)
- [CVE-2026-67359: J2Store order information disclosure](https://junglewise.ai/threats/cve-2026-67359-j2store-order-information-disclosure) (info, published 21 Aug 2026)
- [CVE-2026-67358: J2Store download quota manipulation and CSRF bypass](https://junglewise.ai/threats/cve-2026-67358-j2store-download-quota-manipulation-and-csrf-bypass) (info, CVSS 0, published 21 Aug 2026)

## Most severe J2commerce.com J2Store vulnerabilities

- [CVE-2026-77999: J2Store PayPal IPN signature bypass and order confirmation fraud](https://junglewise.ai/threats/cve-2026-77999-j2store-paypal-ipn-signature-bypass-and-order-confirmation-fraud) (info, CVSS 9.1, published 3 Sep 2026)
- [CVE-2026-82189: J2Store order status manipulation via unauthenticated request](https://junglewise.ai/threats/cve-2026-82189-j2store-order-status-manipulation-via-unauthenticated-request) (info, CVSS 7.5, published 15 Sep 2026)
- [CVE-2026-78064: J2Store anonymous cart tampering via FOF save task](https://junglewise.ai/threats/cve-2026-78064-j2store-anonymous-cart-tampering-via-fof-save-task) (info, CVSS 7.5, published 3 Sep 2026)
- [CVE-2026-81567: J2Store SQL injection in storefront product list](https://junglewise.ai/threats/cve-2026-81567-j2store-sql-injection-in-storefront-product-list) (info, CVSS 7.5, published 15 Sep 2026)
- [CVE-2026-81568: J2Store arbitrary file read via path traversal in download handler](https://junglewise.ai/threats/cve-2026-81568-j2store-arbitrary-file-read-via-path-traversal-in-download) (info, CVSS 6.5, published 15 Sep 2026)
- [CVE-2026-67360: J2Store cross-customer order replication in cart checkout](https://junglewise.ai/threats/cve-2026-67360-j2store-cross-customer-order-replication-in-cart-checkout) (info, CVSS 5.7, published 21 Aug 2026)
- [CVE-2026-78065: J2Store guest checkout address disclosure via IDOR](https://junglewise.ai/threats/cve-2026-78065-j2store-guest-checkout-address-disclosure-via-idor) (info, CVSS 4.3, published 3 Sep 2026)
- [CVE-2026-82191: J2Store PayPal parameter injection in redirect](https://junglewise.ai/threats/cve-2026-82191-j2store-paypal-parameter-injection-in-redirect) (info, CVSS 2.7, published 15 Sep 2026)
- [CVE-2026-82190: J2Store predictable order access token](https://junglewise.ai/threats/cve-2026-82190-j2store-predictable-order-access-token) (info, CVSS 0, published 15 Sep 2026)
- [CVE-2026-67358: J2Store download quota manipulation and CSRF bypass](https://junglewise.ai/threats/cve-2026-67358-j2store-download-quota-manipulation-and-csrf-bypass) (info, CVSS 0, published 21 Aug 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 6 vulnerabilities in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 5 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 5 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 6 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "J2commerce.com J2Store vulnerabilities", https://junglewise.ai/threats/technologies/j2store, 9 November 2026.