SP Page Builder CVE-2026-102426

Exploitation requires the SP Page Builder Pro Dynamic Content Filter addon to be in use on a page with a slider field, since the flaw is in how the slider minimum/maximum values from the dc_filter_<fieldId> request parameter are rendered - split on the 'l-r' delimiter and echoed unescaped as the span element's text content. No authentication is needed (PR:N), but successful attack requires user interaction (UI:P): a victim must load the attacker-supplied URL carrying the crafted parameter. Limiting factors are the need to deliver the link to and have it opened by a victim, the dependency on the Dynamic Content Filter addon actually being deployed and configured with the affected field, and the browser-scoped, non-persistent nature of reflected XSS (no server-side compromise).

This is a medium-severity reflected cross-site scripting flaw (CVSS 4.0 base 5.3) in the Dynamic Content Filter addon of SP Page Builder Pro for Joomla. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates a network-reachable, low-complexity, unauthenticated attack that nonetheless requires victim interaction (UI:P) - the victim must follow a crafted link carrying the malicious dc_filter_<fieldId> parameter. Impact is limited to low confidentiality, integrity, and availability on the vulnerable system only (VC:L/VI:L/VA:L, SC/SI/SA:N), consistent with reflected XSS that executes in the victim's browser session rather than compromising the server. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. On balance this is a real but moderate-priority issue typical of reflected XSS: the unauthenticated network vector and clear technical root cause (double-handling of the value - HTML-escaped in the data-value attribute but echoed unescaped as span text content) make exploitation straightforward for a skilled attacker, but the required user interaction and browser-scoped, non-persistent impact keep it well below the urgency of a server-side RCE or a persistent/stored XSS. Prioritize patching, but it does not warrant emergency out-of-band response absent exploitation signals.

An attacker crafts a URL to a Joomla site running SP Page Builder Pro with a malicious dc_filter_<fieldId> parameter whose value, split on the 'l-r' delimiter, injects script into the slider span's text content. The attacker delivers the link via phishing email, malicious ad, or a forum post; when a victim clicks it, the arbitrary HTML/JavaScript reflects into the rendered page and executes in their browser, enabling session/cookie theft or UI redress. No public proof-of-concept exploit was identified in the provided data.