Description
A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-02
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in OpenCart’s Autocomplete Workflow, specifically in catalog/controller/account/edit.php. By manipulating the firstname argument, an attacker can inject arbitrary JavaScript, leading to a reflected cross‑site scripting attack.

Affected Systems

OpenCart 4.1.0.3 and 4.1.0.4. These versions contain the vulnerable edit.php file within the Autocomplete Workflow component, and any system running either version is impacted regardless of deployment size or architecture.

Risk and Exploitability

The CVSS score of 5.1 places this issue in the moderate severity range. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be initiated remotely, and an exploit has been publicly disclosed, indicating a realistic threat of exploitation. The flaw permits arbitrary JavaScript execution, which is the core of the XSS effect described.

Generated by OpenCVE AI on September 2, 2026 at 04:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenCart to a version that includes the fixed code for the Autocomplete Workflow in catalog/controller/account/edit.php.
  • If immediate upgrade is not feasible, apply a temporary workaround by sanitizing or escaping the firstname input before rendering, such as using a server‑side HTML encoder or a strict allowlist of safe characters.
  • Consider disabling or restricting access to the Autocomplete Workflow or the account editing functionality until the patch is applied, for example by removing the route or setting authentication levels.

Generated by OpenCVE AI on September 2, 2026 at 04:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 02:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title OpenCart Autocomplete Workflow edit.php cross site scripting
First Time appeared Opencart
Opencart opencart
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:*
Vendors & Products Opencart
Opencart opencart
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Opencart Opencart
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-02T01:45:11.465Z

Reserved: 2026-09-01T19:18:45.890Z

Link: CVE-2026-84438

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-02T02:17:20.270

Modified: 2026-09-02T02:17:20.270

Link: CVE-2026-84438

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T04:45:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')