# J2commerce.com vulnerabilities

Source: https://junglewise.ai/threats/vendors/j2commerce-com  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/j2commerce-com.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 14 vulnerabilities in J2commerce.com: 0 in the last 7 days and 14 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-82191, was published on 15 September 2026. Nothing in the last four weeks, down from 4 vulnerabilities in the four before. 1 technology has a page of its own.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 14
- All time: 14 (0 critical, 0 exploited in the wild)

## Latest J2commerce.com vulnerabilities

- [CVE-2026-82191: J2Store PayPal parameter injection in redirect](https://junglewise.ai/threats/cve-2026-82191-j2store-paypal-parameter-injection-in-redirect) (info, CVSS 2.7, published 15 Sep 2026)
- [CVE-2026-82189: J2Store order status manipulation via unauthenticated request](https://junglewise.ai/threats/cve-2026-82189-j2store-order-status-manipulation-via-unauthenticated-request) (info, CVSS 7.5, published 15 Sep 2026)
- [CVE-2026-81567: J2Store SQL injection in storefront product list](https://junglewise.ai/threats/cve-2026-81567-j2store-sql-injection-in-storefront-product-list) (info, CVSS 7.5, published 15 Sep 2026)
- [CVE-2026-78081: J2Commerce J2Store missing CSRF protection in checkout controllers](https://junglewise.ai/threats/cve-2026-78081-j2commerce-j2store-missing-csrf-protection-in-checkout) (info, published 15 Sep 2026)
- [CVE-2026-78069: J2Store missing authorization in Apps controller](https://junglewise.ai/threats/cve-2026-78069-j2store-missing-authorization-in-apps-controller) (info, published 3 Sep 2026)
- [CVE-2026-78065: J2Store guest checkout address disclosure via IDOR](https://junglewise.ai/threats/cve-2026-78065-j2store-guest-checkout-address-disclosure-via-idor) (info, CVSS 4.3, published 3 Sep 2026)
- [CVE-2026-78064: J2Store anonymous cart tampering via FOF save task](https://junglewise.ai/threats/cve-2026-78064-j2store-anonymous-cart-tampering-via-fof-save-task) (info, CVSS 7.5, published 3 Sep 2026)
- [CVE-2026-78000: J2Store reflected XSS via filter_tag, pricefrom, priceto parameters](https://junglewise.ai/threats/cve-2026-78000-j2store-reflected-xss-via-filter-tag-pricefrom-priceto-parameters) (info, published 3 Sep 2026)
- [CVE-2026-77999: J2Store PayPal IPN signature bypass and order confirmation fraud](https://junglewise.ai/threats/cve-2026-77999-j2store-paypal-ipn-signature-bypass-and-order-confirmation-fraud) (info, CVSS 9.1, published 3 Sep 2026)
- [CVE-2026-74252: J2Commerce stored XSS in guest checkout billing fields](https://junglewise.ai/threats/cve-2026-74252-j2commerce-stored-xss-in-guest-checkout-billing-fields) (info, CVSS 7.1, published 21 Aug 2026)
- [CVE-2026-67362: J2Store open redirect in cart controller](https://junglewise.ai/threats/cve-2026-67362-j2store-open-redirect-in-cart-controller) (info, published 21 Aug 2026)
- [CVE-2026-67360: J2Store cross-customer order replication in cart checkout](https://junglewise.ai/threats/cve-2026-67360-j2store-cross-customer-order-replication-in-cart-checkout) (info, CVSS 5.7, published 21 Aug 2026)
- [CVE-2026-67359: J2Store order information disclosure](https://junglewise.ai/threats/cve-2026-67359-j2store-order-information-disclosure) (info, published 21 Aug 2026)
- [CVE-2026-67358: J2Store download quota manipulation and CSRF bypass](https://junglewise.ai/threats/cve-2026-67358-j2store-download-quota-manipulation-and-csrf-bypass) (info, CVSS 0, published 21 Aug 2026)

## Most severe J2commerce.com vulnerabilities

- [CVE-2026-77999: J2Store PayPal IPN signature bypass and order confirmation fraud](https://junglewise.ai/threats/cve-2026-77999-j2store-paypal-ipn-signature-bypass-and-order-confirmation-fraud) (info, CVSS 9.1, published 3 Sep 2026)
- [CVE-2026-82189: J2Store order status manipulation via unauthenticated request](https://junglewise.ai/threats/cve-2026-82189-j2store-order-status-manipulation-via-unauthenticated-request) (info, CVSS 7.5, published 15 Sep 2026)
- [CVE-2026-78064: J2Store anonymous cart tampering via FOF save task](https://junglewise.ai/threats/cve-2026-78064-j2store-anonymous-cart-tampering-via-fof-save-task) (info, CVSS 7.5, published 3 Sep 2026)
- [CVE-2026-81567: J2Store SQL injection in storefront product list](https://junglewise.ai/threats/cve-2026-81567-j2store-sql-injection-in-storefront-product-list) (info, CVSS 7.5, published 15 Sep 2026)
- [CVE-2026-74252: J2Commerce stored XSS in guest checkout billing fields](https://junglewise.ai/threats/cve-2026-74252-j2commerce-stored-xss-in-guest-checkout-billing-fields) (info, CVSS 7.1, published 21 Aug 2026)
- [CVE-2026-67360: J2Store cross-customer order replication in cart checkout](https://junglewise.ai/threats/cve-2026-67360-j2store-cross-customer-order-replication-in-cart-checkout) (info, CVSS 5.7, published 21 Aug 2026)
- [CVE-2026-78065: J2Store guest checkout address disclosure via IDOR](https://junglewise.ai/threats/cve-2026-78065-j2store-guest-checkout-address-disclosure-via-idor) (info, CVSS 4.3, published 3 Sep 2026)
- [CVE-2026-82191: J2Store PayPal parameter injection in redirect](https://junglewise.ai/threats/cve-2026-82191-j2store-paypal-parameter-injection-in-redirect) (info, CVSS 2.7, published 15 Sep 2026)
- [CVE-2026-67358: J2Store download quota manipulation and CSRF bypass](https://junglewise.ai/threats/cve-2026-67358-j2store-download-quota-manipulation-and-csrf-bypass) (info, CVSS 0, published 21 Aug 2026)
- [CVE-2026-78000: J2Store reflected XSS via filter_tag, pricefrom, priceto parameters](https://junglewise.ai/threats/cve-2026-78000-j2store-reflected-xss-via-filter-tag-pricefrom-priceto-parameters) (info, published 3 Sep 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 4 vulnerabilities in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 5 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 5 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 4 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## J2commerce.com technologies

- [J2commerce.com J2Store](https://junglewise.ai/threats/technologies/j2store): 16 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "J2commerce.com vulnerabilities", https://junglewise.ai/threats/vendors/j2commerce-com, 9 November 2026.