Update Immediately
Critical
If your store runs an affected version, update it the day the advisory is published. If a settings change reduces the risk until you can update, the advisory explains it.
Security Center
Report a security issue privately.
Send your report through the private form, see each step from report to fix, and learn how soon to update your store for each severity.
Severity Scale
Know how soon to update your store.
Each advisory is rated Critical, High, Medium or Low, and the rating tells you how soon to update.
-
-
Update Soon
High
Update within the week. These issues usually depend on a specific setting being turned on, and the advisory names it.
-
Update on Schedule
Medium
Include it in your next planned update. The fix ships in a regular release.
-
Update When Convenient
Low
Fixes with little or no impact on a typical store. We publish them so every fix is on record.
Published Advisories
Read every security advisory we have published.
Each advisory names the affected versions and the releases that fix them, with the newest first.
-
Security Announcement: Releases 3.3.23, 4.0.23 and 4.1.8
- Affected Versions
- All J2Store versions prior to 4.1.8
- Fixed In
- J2Store 3.3.23, 4.0.23 and 4.1.8
- Overall Severity
- High. CVSS 4.0 scores range from 4.5 to 8.7
-
Security Announcement: Releases 3.3.22, 4.0.22 and 4.1.7
- Affected Versions
- All J2Store versions prior to 4.1.7
- Fixed In
- J2Store 3.3.22, 4.0.22 and 4.1.7
- Overall Severity
- High. CVSS 4.0 scores range from 5.3 to 9.4
-
J2Store File Upload Security Fix: What You Need to Know
A security fix was released in J2Store 3.3.21, 4.0.21 and 4.1.6 for the file upload feature customers use to attach files to their cart. The issue was exploited in the wild before the fix was relea…
-
Security Announcement: Releases 3.3.21, 4.0.21 and 4.1.6
- Affected Versions
- All J2Store versions prior to 4.1.6
- Fixed In
- J2Store 3.3.21, 4.0.21 and 4.1.6
- Overall Severity
- High. CVSS 4.0 scores range from 5.1 to 8.7
Reporting
Report a vulnerability privately.
Use the private form, not a public GitHub issue, so the details stay private until the fix is released.
You do not need an account, a purchase or a support plan to send a report. Anyone can use this form, including people who have never installed J2Commerce.
Please Include
- The exact version of core, and of the extension if one is involved
- Your Joomla and PHP versions, and anything unusual about your configuration
- The steps you took, in order, and what you saw at the end
- Whether you want to be credited, and the name or handle to use
Please Do Not
- Post a public issue or social media post before the fix is released
- Test against a store you do not own or have written permission to test
- Read, keep or publish anyone else’s order or customer data
- Run load or denial-of-service tests against any service we run
If you report in good faith and follow these guidelines, we will not take action against you.
What Happens Next
See what happens after you report.
We confirm your report, fix the issue, release the update and publish the advisory, with credit to you if you want it.
-
Acknowledged
We reply to confirm we received your report and tell you who is handling it.
-
Reproduced and Rated
We reproduce the issue on a supported version, confirm which versions are affected and assign one of the four severities. We tell you the rating, and you can disagree with it.
-
Fixed in Private
The fix is written and reviewed without a public issue describing the problem. Commit messages describe the change, not how to exploit it.
-
Released
Critical and High fixes ship in their own release when the next regular release is not close. Medium and Low fixes ship in the next regular release. Either way, the release notes record the fix.
-
Published
We publish the advisory once the fix is available, crediting your name or handle if you asked, or “reported internally” if we found it ourselves. An external identifier is added when one is issued.
