CVE-2019-9184: j2store

Critical severity, CVSS 9.8. EPSS: 9% chance of exploitation in the next 30 days.

SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the product_option[] parameter.

Affected products

• j2store j2store: from 3.3.0, before 3.3.7 (fixed in 3.3.7)

Published 2019-02-26. Last modified 2026-06-17.