What’s Vulnerable › Vulnerabilities

CVE-2023-54364: Joomla HikaShop 4.7.4 Reflected XSS via Product Filter

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-09 · updated 2026-09-26
• Weakness: CWE-79

Description

Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the from_option, from_ctrl, from_task, or from_itemid parameters to steal session tokens or login credentials when victims visit the link.

Affected products

• Hikashop Joomla HikaShop: 4.7.4

References

• https://demo.hikashop.com/index.php/en/
• https://www.exploit-db.com/exploits/51629
• https://www.hikashop.com/
• https://www.vulncheck.com/advisories/joomla-hikashop-reflected-xss-via-product-filter

Get alerted when CVE-2023-54364 or the next vulnerability affects your stack