The vulnerability is a reflected XSS in the J2Store extension for Joomla, where four task handlers accept a base64‑encoded URL from user input and redirect to it without validating the destination host. The attack enables an attacker to craft a link that appears to come from the trusted shop domain and redirect users to malicious phishing sites. This can lead to credential theft or session hijacking as the victim trusts the redirect URL.

Affected versions of the J2Store extension for Joomla include 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. Users of the j2commerce.com J2Store extension should verify the running version and apply any available vendor updates.

The CVSS score of 5.3 indicates moderate severity, and no authentication or privileged access is required to exploit the flaw. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting current exploitation is limited. Nonetheless, an attacker can abuse the open redirect in a phishing campaign by embedding a base64‑encoded URL in an invitation or a marketing link. The lack of host validation means that any external site can be targeted, while the reflected XSS component can be exploited to inject malicious scripts into the shop’s pages.