CVE-2026-84437 OpenCart CVE debrief

Who should care

Defenders responsible for OpenCart installations, particularly those using versions 4.1.0.3 or 4.1.0.4, should assess their exposure to this vulnerability and consider applying patches or workarounds.

Why it matters

CVE-2026-84437 is a cross-site scripting vulnerability in OpenCart 4.1.0.3/4.1.0.4 that can be exploited remotely. Defenders should verify exposure, consider patches or workarounds, and monitor for potential exploitation attempts.

• Defenders need to verify the presence of this vulnerability in their OpenCart installations.
• Exploitation of this vulnerability could lead to cross-site scripting attacks.
• Defenders should prioritize patching or applying workarounds to mitigate this vulnerability.
• The public availability of exploits increases the urgency for defenders to take action.

Technical summary

The vulnerability is located in the catalog/controller/account/address.php file of the OpenCart 4.1.0.3/4.1.0.4 Autocomplete Workflow. The address_1 argument can be manipulated to inject malicious scripts, allowing for cross-site scripting attacks. The CVSS score for this vulnerability is 2, indicating a low severity. Defenders should verify the presence of this vulnerability in their OpenCart installations and consider applying patches or workarounds until an official fix is available. The exploit has been made public, and although the vendor was contacted, no response was received.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their OpenCart installations and consider applying patches or workarounds until an official fix is available.

Recommended defensive actions

• Verify the presence of OpenCart 4.1.0.3 or 4.1.0.4 in your environment and assess exposure.
• Consider applying patches or workarounds to mitigate the cross-site scripting vulnerability.
• Monitor for potential exploitation attempts targeting this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. Additional information is available from source references, including a GitHub PoC and VulDB entries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.