Reflected XSS in Joomla VirtueMart 4.0.12 Enables Credential Theft

Publication date: 2026-04-09

Last updated on: 2026-04-09

Assigner: VulnCheck

Description

Joomla VirtueMart Shopping-Cart 4.0.12 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the keyword parameter. Attackers can craft malicious URLs containing script payloads in the keyword parameter of the product-variants endpoint to execute arbitrary JavaScript in victim browsers and steal session tokens or credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-04-09

Generated

2026-07-06

AI Q&A

2026-04-10

EPSS Evaluated

2026-07-05

NVD

CVE-2023-54362

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	virtuemart	4.0.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue in Joomla VirtueMart Shopping-Cart version 4.0.12. It occurs because attackers can manipulate the 'keyword' parameter in the product-variants endpoint to inject malicious scripts. When a victim clicks on a crafted URL containing this malicious script, the script executes in their browser.

The attacker can use this to run arbitrary JavaScript code in the victim's browser, potentially stealing session tokens or credentials.

Impact Analysis

This vulnerability can impact you by allowing attackers to execute malicious scripts in your browser when you visit a specially crafted URL. This can lead to theft of your session tokens or credentials, which attackers can use to impersonate you or gain unauthorized access to your account.

Hi! I’m here to help you understand CVE-2023-54362. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70