DJ-HelpfulArticles CVE-2026-102800

Exploitation requires the DJ-HelpfulArticles 'was this article helpful' voting widget (mod_djhelpful_articles) to be deployed and reachable via com_ajax on a Joomla site running a version below 1.3.0 (affected 1.0.0-1.2.0). The injection step needs no authentication, no CSRF token, and is not rate-limited: the attacker directly supplies the 'ip' field to the getDeny/getConfirm/getDenyReason handlers, which store it as submitted rather than deriving it from the connection. The key limiting factor is that the stored payload only executes when a logged-in administrator opens the backend 'Helpful articles' items overview (views/items/tmpl/default.php) - this is the passive user interaction (UI:P) the CVSS vector reflects, so impact depends on an administrator viewing that page.

The signals are moderately consistent and point to a credible but conditional priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, score 8.7) and CWE-79 describe an unauthenticated, network-reachable stored XSS requiring only passive interaction from a victim - specifically an administrator viewing the backend overview. The vuln.today decision label is 'this_week' rather than act_now or emergency, which fits a serious-but-not-actively-exploited issue. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no evidence of active exploitation or published exploit code at time of analysis. The main nuance is that the stored payload only fires when a logged-in administrator opens the 'Helpful articles' items view, so impact is gated on admin behavior rather than being a direct server takeover; this makes it lower urgency than a true unauthenticated RCE but still significant because the injection point is completely unauthenticated and the execution context is the Joomla administrator session. The vendor's VA:H (availability) rating is difficult to justify for an HTML-output XSS and appears overstated; treat the confidentiality/integrity exposure of the admin session as the real risk. Net: a real priority for sites running the affected extension, aligned with the 'this_week' label, but not an emergency given no exploitation or exploit-code evidence.

An unauthenticated attacker sends a crafted request to the com_ajax voting handlers (getDeny/getConfirm/getDenyReason) with a malicious JavaScript payload in the client-supplied 'ip' field, which is stored verbatim. When a Joomla administrator later opens the 'Helpful articles' overview in the backend, the payload renders unescaped and executes in the administrator's authenticated session. No public exploit was identified at time of analysis, but the attack is low-complexity and needs no authentication to plant the payload.