Helix Ultimate CVE-2026-103419

Exploitation requires an authenticated Joomla user with access to the Helix Ultimate Media Picker (PR:L - a low-privileged backend foothold, not anonymous access), and it requires victim interaction (UI:P): a second user must view the page where the stored payload renders for the script to fire. It is limited to Helix Ultimate versions below 2.2.11; sites on 2.2.11 or later are not affected. The realistic impact depends on the privilege of the victim who triggers the payload - high if that is an administrator in the backend, lower if only equal/lower-privileged users render it. The available sources do not describe the exact Media Picker field or parameter that must be abused.

This is a stored XSS (CWE-79) in the Helix Ultimate Media Picker, rated CVSS 4.0 8.6 (High) by the reporter. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P tells a consistent story: network-reachable and low-complexity, but NOT unauthenticated - PR:L means the attacker needs an existing low-privileged Joomla backend account, and UI:P means a victim must passively interact with the page where the payload renders. This materially lowers real-world risk below what the 8.6 headline implies. There is no EPSS score provided, the vulnerability is NOT on the CISA KEV list, and no POC or exploit reference appears in the input (the only reference is the vendor product page). So the exploitation signal is: no public exploit identified at time of analysis. The vuln.today priority Decision label is 'this_week' - a remediate-promptly signal, not act_now or emergency. Net: a genuine, credible authenticated stored-XSS requiring both a foothold account and victim interaction - a real patch-this-sprint item, not a drop-everything internet-wide threat. Note the impact tension: the 4.0 vector claims VC:H/VI:H (high confidentiality and integrity impact), which for a stored XSS is only justified if the payload executes in a high-privilege (administrator) context such as the Joomla backend Media Picker; the available sources do not explicitly state the victim's privilege level, so that high-impact rating is plausible but not independently confirmed.

An attacker with a low-privileged Joomla backend account (e.g., an author/editor with Media Picker access) stores a malicious script payload through the Helix Ultimate Media Picker. When a higher-privileged user such as a site administrator later opens the view that renders this media, the script executes in their authenticated browser session, enabling session/cookie theft or actions performed as that user. No public exploit code is identified at time of analysis; the specific injection point and sink are not described in the available sources.