Helix Ultimate Extension For Joomla
Monthly
Stored cross-site scripting in the Helix Ultimate template framework for Joomla (all versions below 2.2.11) lets an authenticated, low-privileged backend user persist script through the Media Picker that then executes in the browser of another user who views the affected page. The reporter (Joomla) rates it CVSS 4.0 8.6 High, while our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) scores it lower because exploitation needs a backend foothold plus victim interaction, and the practical impact scales with the privilege of whoever renders the payload - an administrator viewing the poisoned page is the worst case, equal- or lower-privileged users are far less damaging. It is prioritized for remediation this week; no public exploit code and no CISA KEV entry were identified at time of analysis.
Stored cross-site scripting in the Mega Menu Badge Text field of the Helix Ultimate template/framework for Joomla before version 2.2.11 lets an authenticated Joomla user with menu or template management privileges plant script that executes when another user - typically an administrator or editor - views a page or admin screen rendering the affected badge. The flaw is CWE-79 and applies only where the Mega Menu feature is actually in use with a badge configured on a menu item; our assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning privileged authoring access plus victim interaction rather than unauthenticated remote exploitation. No public exploit code or confirmed active exploitation was identified in the available sources; the vendor has released version 2.2.11 as the fixed release.
Stored XSS in the Helix Ultimate Joomla extension (versions before 2.2.10) allows authenticated administrators to plant persistent malicious JavaScript through MegaMenu layout configuration fields, which subsequently executes in the browsers of all site visitors who load affected pages. Column and item configuration values within the MegaMenu layout JSON were persisted and rendered without complete contextual escaping, enabling injection of arbitrary HTML and script payloads. The vendor has released version 2.2.10 with stricter sanitization via Joomla's InputFilter and PHP's htmlspecialchars; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Arbitrary file deletion in JoomShaper's Helix Ultimate template framework for Joomla allows unauthenticated remote attackers to delete files on the server due to a missing authorization check (CWE-862). Any anonymous user can reach the vulnerable functionality without credentials (PR:N/UI:N), enabling deletion of critical Joomla files to corrupt or take down the site. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored cross-site scripting in JoomShaper's Helix Ultimate template framework for Joomla lets unauthenticated attackers persist malicious JavaScript that executes in a victim's browser when the affected page is viewed. Because injection requires no authentication (PR:N) but relies on a victim rendering the poisoned content (UI:P), an attacker can hijack sessions, steal credentials, or perform actions as high-privilege administrators who visit the page. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Open redirect in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows unauthenticated network-accessible attackers to craft redirect URLs that bypass the site's origin validation. The return parameter accepts arbitrary Base64-encoded strings without invoking Joomla's Uri::isInternal() check, meaning the decoded destination is never validated as belonging to the host site. An attacker can exploit this to redirect victims to attacker-controlled external domains, enabling highly convincing phishing campaigns that abuse the trusted appearance of the legitimate site URL. No active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Helix Ultimate template framework for Joomla (all versions below 2.2.11) lets an authenticated, low-privileged backend user persist script through the Media Picker that then executes in the browser of another user who views the affected page. The reporter (Joomla) rates it CVSS 4.0 8.6 High, while our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) scores it lower because exploitation needs a backend foothold plus victim interaction, and the practical impact scales with the privilege of whoever renders the payload - an administrator viewing the poisoned page is the worst case, equal- or lower-privileged users are far less damaging. It is prioritized for remediation this week; no public exploit code and no CISA KEV entry were identified at time of analysis.
Stored cross-site scripting in the Mega Menu Badge Text field of the Helix Ultimate template/framework for Joomla before version 2.2.11 lets an authenticated Joomla user with menu or template management privileges plant script that executes when another user - typically an administrator or editor - views a page or admin screen rendering the affected badge. The flaw is CWE-79 and applies only where the Mega Menu feature is actually in use with a badge configured on a menu item; our assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning privileged authoring access plus victim interaction rather than unauthenticated remote exploitation. No public exploit code or confirmed active exploitation was identified in the available sources; the vendor has released version 2.2.11 as the fixed release.
Stored XSS in the Helix Ultimate Joomla extension (versions before 2.2.10) allows authenticated administrators to plant persistent malicious JavaScript through MegaMenu layout configuration fields, which subsequently executes in the browsers of all site visitors who load affected pages. Column and item configuration values within the MegaMenu layout JSON were persisted and rendered without complete contextual escaping, enabling injection of arbitrary HTML and script payloads. The vendor has released version 2.2.10 with stricter sanitization via Joomla's InputFilter and PHP's htmlspecialchars; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Arbitrary file deletion in JoomShaper's Helix Ultimate template framework for Joomla allows unauthenticated remote attackers to delete files on the server due to a missing authorization check (CWE-862). Any anonymous user can reach the vulnerable functionality without credentials (PR:N/UI:N), enabling deletion of critical Joomla files to corrupt or take down the site. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored cross-site scripting in JoomShaper's Helix Ultimate template framework for Joomla lets unauthenticated attackers persist malicious JavaScript that executes in a victim's browser when the affected page is viewed. Because injection requires no authentication (PR:N) but relies on a victim rendering the poisoned content (UI:P), an attacker can hijack sessions, steal credentials, or perform actions as high-privilege administrators who visit the page. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Open redirect in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows unauthenticated network-accessible attackers to craft redirect URLs that bypass the site's origin validation. The return parameter accepts arbitrary Base64-encoded strings without invoking Joomla's Uri::isInternal() check, meaning the decoded destination is never validated as belonging to the host site. An attacker can exploit this to redirect victims to attacker-controlled external domains, enabling highly convincing phishing campaigns that abuse the trusted appearance of the legitimate site URL. No active exploitation has been identified at time of analysis.