EUVD-2026-46059
GHSA-hxf2-968r-35qp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H confirmed by CVSS 4.0 source; S:C and UI:R applied because stored XSS executes in victims' browser context, requiring a passive victim page load.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
1DescriptionCVE.org
The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder users could break out of id/class fields that render for public users.
AnalysisAI
Stored cross-site scripting in Quix Page Builder Pro, a Joomla CMS extension by ThemeXpert, allows authenticated builder-role users to inject persistent malicious scripts by breaking out of id/class HTML attribute fields rendered in public-facing pages. The payload executes in the browsers of any visitor loading the affected page, enabling session hijacking, phishing redirects, or malware delivery at scale across the site's audience. No public exploit code or active exploitation has been identified at time of analysis, and no confirmed patched version is available from the provided references.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes the root cause: user-controlled input is stored without adequate sanitization and later reflected in rendered HTML. In Quix Page Builder Pro, the drag-and-drop page builder interface exposes id and class attribute fields for HTML elements; these CSS-selector inputs accept arbitrary strings that are persisted to the database and injected directly into page markup. An attacker can break out of the attribute context (e.g., using quote characters followed by event handler attributes) to embed JavaScript that fires for every public visitor. The CPE string cpe:2.3:a:themexpert.com:quix_page_builder_pro_extension_for_joomla:*:*:*:*:*:*:*:* covers all known versions with no upper bound, indicating the entire product history is potentially affected. The Joomla CMS is the underlying platform; the vulnerability is specific to this third-party extension, not Joomla core.
RemediationAI
Monitor the vendor's product page at https://www.themexpert.com/quix-pagebuilder for a patched release and apply it immediately when one is published; no fixed version has been confirmed from available data at time of analysis. As compensating controls pending a patch: restrict builder-role access to the smallest possible set of fully trusted users, since the attack requires high-privilege authentication - removing unnecessary builder accounts eliminates the attack vector entirely. Audit existing pages built with Quix Page Builder Pro for unexpected JavaScript payloads embedded in id or class attributes of page elements. Consider deploying a strict Content Security Policy (CSP) header that blocks inline script execution; note that many Joomla extensions rely on inline scripts, so a strict CSP requires compatibility testing before production deployment. If the builder extension is not actively required, disabling Quix Page Builder Pro is the most effective interim mitigation.
Authenticated PHP code execution in ThemeXpert's Quix Page Builder Pro extension for Joomla lets a privileged builder us
Arbitrary file disclosure in ThemeXpert's Quix Page Builder Pro extension for Joomla allows unauthenticated frontend use
Improper access control in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets authenticated users uploa
SQL injection in the Quix Page Builder Pro extension for Joomla lets remote unauthenticated attackers inject arbitrary S
Stored cross-site scripting in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets an authenticated buil
Information disclosure in the Quix Page Builder Pro Joomla extension exposes raw exception data to unauthenticated remot
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today