What is the CVSS score of CVE-2026-66490?

CVE-2026-66490 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Gridbox CVE-2026-66490

EUVD-2026-50333 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-29 Joomla

GHSA-6432-frr4-pgf6

XSS Gridbox Extension For Joomla

6.1

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L assigned independently because comment avatar submission in Joomla extensions typically requires a registered account; PR:N from the source report is unconfirmed from available data.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 16:27 vuln.today

CVSS changed

Jul 29, 2026 - 15:22 NVD

6.1 (MEDIUM)

CVE Published

Jul 29, 2026 - 13:54 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

AnalysisAI

Stored cross-site scripting in the Gridbox Joomla extension by balbooa.com allows attackers to inject persistent malicious scripts via the comment avatar field, affecting all releases from version 1.0.0 through 2.20.1. The payload is stored server-side and executes in the browsers of all subsequent visitors who load the affected page, with scope change enabling cross-origin impact such as session theft or UI manipulation. No public exploit code or active exploitation has been identified at time of analysis; the vendor released version 2.20.2 as the corrective fix.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) underlies this stored XSS flaw in the Gridbox visual page-builder extension for Joomla (CPE: cpe:2.3:a:balbooa.com:gridbox_extension_for_joomla:*:*:*:*:*:*:*:*). The comment avatar field - used to associate a profile image or avatar metadata with user-submitted comments inside the Gridbox builder - fails to sanitize or HTML-encode attacker-controlled input before rendering it in page output. Because the malicious payload is persisted on the server rather than reflected ephemerally, every visitor who loads the page is a potential victim, amplifying the effective blast radius compared to reflected XSS. The vulnerability is hosted within the Joomla CMS ecosystem, meaning the attack surface is bounded by whichever Joomla sites have Gridbox installed and its comment feature enabled.

RemediationAI

Upgrade Gridbox to version 2.20.2 or later using the Joomla Extensions Manager, which is the vendor-released fix for this stored XSS. If immediate upgrade is not feasible, disable the Gridbox comment feature in the extension's configuration to eliminate the vulnerable input surface - note this removes user commenting functionality as a trade-off. Alternatively, restricting comment submission to authenticated, trusted Joomla user groups via ACL rules reduces the attacker pool if open/anonymous commenting is currently permitted. The vendor product changelog and advisory are referenced at https://www.balbooa.com/gridbox; the vulnerability disclosure is at https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/; and the NVD entry is at https://nvd.nist.gov/vuln/detail/CVE-2026-66490.