Joomla HikaShop 4.7.4 contains a reflected cross‑site scripting flaw that allows attackers to inject malicious scripts by manipulating the GET parameters of the product filter endpoint. By crafting URLs that include XSS payloads in the from_option, from_ctrl, from_task, or from_itemid fields, an unauthenticated attacker can cause the victim’s browser to execute user‑supplied code. When a user opens the link, the script can steal session tokens or login credentials, compromising the victim’s account.

The vulnerability affects any installation of Joomla HikaShop version 4.7.4. Any site running this exact version and using the product filter component is susceptible, regardless of the overall Joomla configuration.

With a CVSS score of 5.1 the flaw carries a moderate impact, and the lack of an EPSS score makes the exact exploit probability unclear. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the issue remotely via a crafted HTTP GET request without needing authentication. The exploit can materialize with any user who clicks the malicious link, potentially leading to credential theft. Due to the absence of a predefined workaround, the risk persists until the vendor releases a patch.