Which versions of SP Page Builder are affected by CVE-2026-66494?

SP Page Builder (Joomla extension) versions prior to 6.7.0 contain a stored cross-site scripting vulnerability enabling unauthenticated remote attackers to inject persistent malicious code into site…

How to fix or mitigate CVE-2026-66494?

Within 24 hours, audit all Joomla installations to identify instances of SP Page Builder below version 6.7.0 and assess business criticality. Within 7 days, disable the SP Page Builder extension on all affected sites-or remove it entirely if not mission-critical-to eliminate the attack vector pending vendor patch availability. Within 30 days, maintain visibility on the JoomShaper advisory channel for patch availability; schedule immediate upgrade to SP Page Builder 6.7.0 or later as soon as released.

SP Page Builder CVE-2026-66494

Q: What is the CVSS score of CVE-2026-66494?

CVE-2026-66494 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-54478 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-07 security@joomla.org

GHSA-vcvg-2gmm-mmpg

XSS

8.7

CVSS 4.0 · Vendor: joomla

Severity by source

Vendor (joomla) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Unauthenticated network injection (AV:N, PR:N), scope changes to admin browser (S:C), enabling session hijack with full C:H and I:H; availability impact unconfirmed by description.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (joomla).

CVSS VectorVendor: joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 13:31 vuln.today

CVE Published

Aug 07, 2026 - 13:16 cve.org

HIGH 8.7

DescriptionCVE.org

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..

AnalysisAI

Stored XSS in SP Page Builder (Joomla extension by JoomShaper) prior to version 6.7.0 allows unauthenticated remote attackers to persist arbitrary JavaScript in a Joomla site's database via a single HTTP request to the Shapes API endpoint. When any administrator subsequently opens the SP Page Builder editor, the payload executes automatically in their browser session, enabling session hijacking, credential theft, or full backend site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection vector combined with automatic detonation on routine admin activity makes this a high-priority patch target for any Joomla installation running this extension.

Technical ContextAI

SP Page Builder is a commercial Joomla CMS page-builder extension developed by JoomShaper, widely used to construct visual page layouts within Joomla sites. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the persistent (stored) variant: the Shapes API endpoint accepts user-supplied input without adequate server-side sanitization or output encoding and writes it directly to the Joomla database. Because the payload is stored rather than reflected, the attack is decoupled into two phases - an unauthenticated write phase and a deferred execution phase triggered when an administrator loads the editor. The Joomla extension architecture means the vulnerable endpoint is typically exposed to the public internet as part of the standard CMS installation, and no authentication is required to interact with the Shapes API in affected versions.

RemediationAI

Update SP Page Builder to version 6.7.0 or later, which is identified in the vulnerability description as the fixed release. The vendor product page at https://www.joomshaper.com/page-builder should be consulted for the official download and changelog. Note that the fix version 6.7.0 is stated in the vulnerability description but has not been independently verified against a published release artifact or commit. If immediate patching is not feasible, restrict unauthenticated access to the Shapes API endpoint at the web server or WAF layer by blocking POST requests to the relevant API path - this prevents the injection phase while leaving the read-only editor functional, though it may break legitimate Shape creation workflows for unauthenticated flows. Additionally, administrators should avoid opening the SP Page Builder editor on unpatched installations until remediation is complete, as that action is the detonation trigger for any already-stored payload.