CVE-2023-54364
Joomla HikaShop 4.7.4 Reflected XSS via Product Filter
CVSS Score
6.1
EPSS Score
0.1%
EPSS Percentile
19th
Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the from_option, from_ctrl, from_task, or from_itemid parameters to steal session tokens or login credentials when victims visit the link.
| CWE | CWE-79 |
| Vendor | hikashop |
| Product | joomla hikashop |
| Published | Apr 9, 2026 |
| Last Updated | Apr 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for hikashop joomla hikashop
Be the first to know when new medium vulnerabilities affecting hikashop joomla hikashop are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
None
Integrity
None
Availability
None
Affected Versions
Hikashop / Joomla HikaShop
4.7.4
References
Credits
CraCkEr