XSS in Hikashop Joomla
CVE-2023-54364
Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the from_option, from_ctrl, from_task, or from_itemid parameters to steal session tokens or login credentials when victims visit the link.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (13.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Hikashop Joomla — versions 4.7.4
Weakness classification (CWE)
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2023-54364?
- CVE-2023-54364 is a medium-severity vulnerability in Hikashop Joomla, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-04-09.
- How severe is CVE-2023-54364?
- Medium severity. CVSS v3 base score is 6.1 out of 10.