Helix Ultimate CVE-2026-105602

Requires an authenticated Joomla user who can edit Mega Menu configuration - specifically the Badge Text field of a menu item (template/menu management privileges), reflected in PR:L. Exploitation is further gated by victim interaction (UI:P): another user, typically an administrator or editor, must load a page or admin view that renders the malicious badge before the stored script fires. It also depends on a non-default setup where the Mega Menu feature is in use and a badge is configured on at least one menu item. These factors - privileged authoring access plus a viewing victim - limit this to a trusted-but-not-fully-privileged insider or a compromised contributor account rather than remote unauthenticated exploitation.

This is a stored XSS (CWE-79) in the Mega Menu Badge Text feature of the Helix Ultimate template/framework for Joomla, affecting versions before 2.2.11. The only CVSS vector supplied is a CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N, score 8.6). That vector indicates network reach, low attack complexity, and - importantly - PR:L and UI:P, meaning exploitation requires an authenticated low-privileged account (one able to edit the Mega Menu badge text, i.e. a template/menu manager) plus passive interaction from a victim who views the rendered menu. No EPSS score, no CISA KEV listing, and no POC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no quantified exploitation probability. The vuln.today priority label is 'this_week' rather than act_now/emergency, which is consistent with a privilege-and-interaction-gated stored XSS rather than a widely weaponized flaw. The 4.0 VC:H/VI:H impact rating appears aggressive for a reflected-into-DOM stored XSS whose real effect is script execution in a viewing user's browser session; I would independently rate the confidentiality/integrity impact as Low (see assessed vectors). Net: a genuine but conditional issue - meaningful because the injected script typically lands in an administrative/editorial context, yet gated behind an authenticated contributor account and victim viewing, so it is a plan-and-patch-this-cycle item, not a drop-everything emergency.

A user with rights to configure the Mega Menu (e.g. a template or menu manager account) enters a malicious script payload into a menu item's Badge Text field instead of a normal label. When a Joomla administrator or another privileged user subsequently opens the page or admin view where that mega-menu badge is rendered, the stored script executes in their browser session, enabling session/token theft or actions in the victim's authenticated context. No public exploit code is referenced in the available data.