Executive Summary

CVE-2025-55757 is an unauthenticated reflected cross-site scripting (XSS) vulnerability in VirtueMart versions 1.0.0 to 4.4.10 for Joomla. This means that an attacker can inject malicious scripts into web pages viewed by other users without needing to be logged in. The vulnerability arises from insufficient input filtering, which was addressed in VirtueMart version 4.6.0 by strengthening and permanently activating input filters to prevent such attacks. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute malicious scripts in the browsers of users visiting a vulnerable VirtueMart site. This can lead to theft of user credentials, session hijacking, defacement of the website, or distribution of malware. Since the vulnerability is unauthenticated, attackers do not need any special access to exploit it, increasing the risk to site users and administrators. [1]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade VirtueMart to version 4.6.0 or later, which includes enhanced input filtering functions that address the reflected XSS vulnerability. Note that version 4.6.0 is incompatible with Joomla 6, so plan accordingly. [1]

Useful 0 Not Useful 0