Fabrik for Joomla EUVD-2026-64330

The Fabrik extension for Joomla must be installed and the jsactions feature must be active on at least one form accessible to unauthenticated users - this is the specific feature that fails to sanitize input. The injection phase requires no authentication (PR:N confirmed by CVSS vector). The impact phase requires a separate user - particularly a privileged one such as a site administrator - to view the page or form where the stored payload renders (UI:A per CVSS 4.0 vector). Sites where Fabrik forms are only accessible to authenticated users partially limit the injection surface but do not eliminate stored XSS risk if lower-privilege users can write to fields viewed by higher-privilege users. No non-default Joomla configuration or special server setting is required beyond having the extension installed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L) scores 8.6 and is internally consistent: the attack is network-accessible, requires no privileges to inject the payload, has low complexity, and produces high confidentiality and integrity impact against the vulnerable system once a user views the content. The UI:A (active user interaction) metric appropriately captures the stored-XSS model - a victim must navigate to the affected page. No EPSS score was provided in the source data, and the vulnerability is absent from CISA KEV, indicating no confirmed mass exploitation. No public proof-of-concept is identified. Despite the absence of active exploitation signals, stored XSS via an unauthenticated write path is structurally more dangerous than reflected XSS: the attacker does not need real-time victim interaction beyond a normal browsing session, and a single injection can persist until the database record is cleaned. The realistic priority is moderate-to-high for any Joomla site exposing Fabrik forms to unauthenticated users, particularly if administrative users also view those forms.

An unauthenticated attacker navigates to a publicly accessible Fabrik form on a Joomla site and submits a crafted input containing JavaScript in a field processed by the jsactions feature. The payload is stored in the database without sanitization. When a site administrator subsequently opens the Fabrik form list or a form management view, the stored script executes in the admin's browser, allowing the attacker to exfiltrate the admin's session cookie or perform actions on behalf of the administrator. No public proof-of-concept is identified at time of analysis.