Which versions of 4Analytics are affected by EUVD-2026-44601?

The 4Analytics Joomla extension contains a stored cross-site scripting vulnerability (CVSS 8.6); no public exploit identified at time of analysis.

4Analytics EUVD-2026-44601

Q: What is the CVSS score of EUVD-2026-44601?

EUVD-2026-44601 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

Q: How to fix or mitigate EUVD-2026-44601?

Within 24 hours, audit your Joomla installation to identify if 4Analytics is installed and active; if present, immediately disable the extension or restrict access to the analytics interface. Within 7 days, contact the extension vendor (weeblr.com) regarding patch availability-no vendor-released patch identified at time of analysis-and implement Web Application Firewall rules to detect and block JavaScript injection attempts targeting the analytics module. Within 30 days, evaluate alternative privacy analytics solutions and establish a migration plan given the lack of available security patch.

| CVE-2026-57833 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-15 Joomla

GHSA-8q44-8chq-65hc

XSS 4Analytics Extension For Joomla

8.6

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection (PR:N) but stored payload requires a victim to view the AI page (UI:R); XSS crosses into the victim's browser (S:C) yielding low confidentiality/integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 09:45 vuln.today

CVE Published

Jul 15, 2026 - 08:59 cve.org

HIGH 8.6

DescriptionCVE.org

The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature.

AnalysisAI

Stored cross-site scripting in the 4Analytics privacy analytics extension for Joomla (by weeblr.com) lets unauthenticated attackers inject persistent JavaScript that executes when a victim views the AI analysis feature. Because injection requires no authentication (PR:N) but execution requires a victim to open the affected view (UI:A), an attacker can seed malicious script that later runs in a privileged operator's browser session. There is no public exploit identified at time of analysis and the extension is not listed in CISA KEV.

Technical ContextAI

4Analytics is a self-hosted, privacy-focused web analytics extension for the Joomla CMS that collects visitor telemetry and, per this report, offers an AI-driven analysis feature that surfaces insights inside the Joomla administrator or reporting interface. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation): attacker-controllable data - plausibly analytics-collected fields such as referrers, URLs, user agents, or event metadata that an unauthenticated visitor can influence - is persisted and later rendered without adequate output encoding when the AI analysis view is displayed. The affected component is identified by CPE cpe:2.3:a:weeblr.com:4analytics_extension_for_joomla:*:*:*:*:*:*:*:*, with the version field wildcarded, meaning no fixed version boundary is asserted in the available data.

RemediationAI

No vendor-released patch identified at time of analysis - the only reference is the product page (https://weeblr.com/joomla-seo/4analytics-private-analytics-for-joomla), not a dedicated advisory or tagged release, so no exact fix version can be cited. Monitor weeblr.com and the Joomla Vulnerable Extensions List for an update and apply it as soon as a patched version is published. As compensating controls until then: disable or avoid opening the 4Analytics AI analysis feature (the specific view where the stored payload executes), which removes the trigger at the cost of losing that reporting capability; restrict access to the Joomla administrator and analytics dashboards to trusted networks/VPN to limit who can trigger the payload; and place a Web Application Firewall in front of the site with rules to strip or encode script-like content in analytics-ingested fields (referrer, user-agent, URL parameters), accepting that WAF filtering may miss obfuscated payloads and can break legitimate data containing HTML-like characters. Consider a strict Content-Security-Policy that disallows inline script as a defense-in-depth measure to blunt execution of injected script.