CVE-2026-84437 OpenCart CVE debrief

Who should care

OpenCart users and administrators, security teams monitoring for cross-site scripting vulnerabilities, and operators managing customer address data should be aware of this vulnerability and take necessary precautions to protect against potential attacks. Review of compensating controls and monitoring is recommended while remediation is scheduled.

Technical summary

The vulnerability is located in the catalog/controller/account/address.php file of OpenCart 4.1.0.3/4.1.0.4, specifically in the Autocomplete Workflow. The manipulation of the address_1 argument leads to cross-site scripting. The attack can be launched remotely. Additional review is recommended to assess potential impact and verify affected deployments. The CVE record was published on 2026-09-02T02:17:20.087Z and has not been modified since then. The vendor was contacted early about this disclosure but did not respond in any way.

Defensive priority

Low CVSS score of 2 indicates limited impact; prioritize patching for customer address data security.

Recommended defensive actions

• Apply vendor patch for OpenCart 4.1.0.3/4.1.0.4
• Monitor customer address data for suspicious activity
• Implement additional security controls for Autocomplete Workflow
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from Vuldb and NVD indicates a cross-site scripting vulnerability in OpenCart 4.1.0.3/4.1.0.4 address.php. Limited detail on exploitability and affected scope. The CVE record was published on 2026-09-02T02:17:20.087Z and has not been modified since then. The vendor was contacted early about this disclosure but did not respond in any way. Additional review is recommended to verify affected deployments and assess potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.