CVE-2023-54362
Received Received - Intake
Reflected XSS in Joomla VirtueMart 4.0.12 Enables Credential Theft

Publication date: 2026-04-09

Last updated on: 2026-04-09

Assigner: VulnCheck

Description
Joomla VirtueMart Shopping-Cart 4.0.12 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the keyword parameter. Attackers can craft malicious URLs containing script payloads in the keyword parameter of the product-variants endpoint to execute arbitrary JavaScript in victim browsers and steal session tokens or credentials.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-09
Last Modified
2026-04-09
Generated
2026-06-16
AI Q&A
2026-04-10
EPSS Evaluated
2026-06-15
NVD
CVE-2023-54362
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
joomla virtuemart 4.0.12
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue in Joomla VirtueMart Shopping-Cart version 4.0.12. It occurs because attackers can manipulate the 'keyword' parameter in the product-variants endpoint to inject malicious scripts. When a victim clicks on a crafted URL containing this malicious script, the script executes in their browser.

The attacker can use this to run arbitrary JavaScript code in the victim's browser, potentially stealing session tokens or credentials.

Impact Analysis

This vulnerability can impact you by allowing attackers to execute malicious scripts in your browser when you visit a specially crafted URL. This can lead to theft of your session tokens or credentials, which attackers can use to impersonate you or gain unauthorized access to your account.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-54362. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart