EUVD-2026-46053
GHSA-c3vf-cjgw-qqp3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires an authenticated builder role (PR:L, not H for a content-editor) and a victim viewing the page (UI:R); XSS executes in the victim browser so scope changes (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG.
AnalysisAI
Stored cross-site scripting in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets an authenticated builder-level user persist malicious scripts - including unsanitised SVG payloads - that then execute in the browser of any visitor or administrator who renders the affected page. Because the payload fires against higher-privileged admins, it enables session/account takeover of the Joomla back end. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Quix is a commercial drag-and-drop page builder extension for the Joomla CMS, used to compose front-end pages from user-supplied content blocks. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): builder content is written to the page without output encoding ('unescaped output') and SVG uploads/embeds are not sanitised, so an attacker can smuggle executable JavaScript via inline event handlers or <script>/<foreignObject> constructs inside SVG. The single affected component per CPE is cpe:2.3:a:themexpert.com:quix_page_builder_pro_extension_for_joomla, and the script executes in the security context (origin) of the Joomla site serving the page.
RemediationAI
No vendor-released patch version is identified in the available data; the only reference is the product page (https://www.themexpert.com/quix-pagebuilder), so administrators should check ThemeXpert for an updated Pro release and apply the latest version once a fix is published. As compensating controls while unpatched: restrict the Joomla builder/editor role to the minimum trusted set of users and audit existing editor accounts, since exploitation requires that privilege (PR:H); disable or block SVG uploads/embeds within Quix content to remove the unsanitised-SVG vector; and place a WAF or CSP in front of the site - a strict Content-Security-Policy that forbids inline script (no 'unsafe-inline') and disallows inline event handlers will neutralise most stored-XSS payloads. Trade-offs: disabling SVG breaks legitimate SVG-based designs, and a strict CSP can break inline scripts used by themes/plugins, so test in staging before enforcing.
Authenticated PHP code execution in ThemeXpert's Quix Page Builder Pro extension for Joomla lets a privileged builder us
Arbitrary file disclosure in ThemeXpert's Quix Page Builder Pro extension for Joomla allows unauthenticated frontend use
Improper access control in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets authenticated users uploa
SQL injection in the Quix Page Builder Pro extension for Joomla lets remote unauthenticated attackers inject arbitrary S
Information disclosure in the Quix Page Builder Pro Joomla extension exposes raw exception data to unauthenticated remot
Stored cross-site scripting in Quix Page Builder Pro, a Joomla CMS extension by ThemeXpert, allows authenticated builder
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today