Joomshaper Com
Monthly
Stored cross-site scripting in the Helix Ultimate template framework for Joomla (all versions below 2.2.11) lets an authenticated, low-privileged backend user persist script through the Media Picker that then executes in the browser of another user who views the affected page. The reporter (Joomla) rates it CVSS 4.0 8.6 High, while our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) scores it lower because exploitation needs a backend foothold plus victim interaction, and the practical impact scales with the privilege of whoever renders the payload - an administrator viewing the poisoned page is the worst case, equal- or lower-privileged users are far less damaging. It is prioritized for remediation this week; no public exploit code and no CISA KEV entry were identified at time of analysis.
Stored cross-site scripting in the Mega Menu Badge Text field of the Helix Ultimate template/framework for Joomla before version 2.2.11 lets an authenticated Joomla user with menu or template management privileges plant script that executes when another user - typically an administrator or editor - views a page or admin screen rendering the affected badge. The flaw is CWE-79 and applies only where the Mega Menu feature is actually in use with a badge configured on a menu item; our assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning privileged authoring access plus victim interaction rather than unauthenticated remote exploitation. No public exploit code or confirmed active exploitation was identified in the available sources; the vendor has released version 2.2.11 as the fixed release.
EasyStore for Joomla versions 1.0.0 through 3.0.0 does not enforce CSRF token verification across most administrator AJAX endpoints, enabling an attacker to trick a logged-in Joomla administrator into changing store data such as orders, coupons, media, customers, settings, tags, categories, reviews, and collections. Only the products() action checked tokens; the vendor fix moves verification into ApiController::execute() and applies Session::checkToken() to POST, PUT, PATCH, and DELETE requests. No public exploit code was identified at time of analysis, and exploitation requires an active admin session plus user interaction, so this is a moderate-risk CSRF issue despite the potential for high integrity and availability impact.
PII harvesting in JoomShaper EasyStore 1.0.0-3.0.0 allows unauthenticated attackers to enumerate guest checkout records via the checkout.searchGuestUser endpoint, which returns full shipping details (name, phone, address) for any supplied email address. Despite vendor labeling as an authenticated SQL injection, the endpoint requires no authentication or session validation and enables bulk collection of customer PII. No public exploit code has been identified at time of analysis; the vendor has resolved the issue by removing the server-side endpoint and migrating autofill to client-side localStorage.
CSRF in JoomShaper EasyStore for Joomla versions 1.0.0 through 3.0.0 allows an attacker to silently modify the core Joomla mail sender name and address (fromname, mailfrom) in configuration.php by tricking a logged-in administrator into visiting a malicious web page. The vulnerable endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration lacks anti-CSRF token validation and administrative authorization checks. Exploitation requires an authenticated admin session (UI:R) but no attacker credentials (PR:N); impact is limited to altering mail sender identity, and no public exploit was identified at time of analysis.
Authenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows a Joomla administrator to inject arbitrary SQL through the coupon bulk update task at administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate. The flaw is a genuine injection (reported as CWE-74, functionally classic CWE-89 SQLi) where coupon IDs are concatenated straight into raw SQL IN (...) clauses instead of being cast to integers or parameterized. Exploitation is confirmed to require high privilege (PR:H in the assessed CVSS:3.1 vector), and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.25% (14th percentile), so despite the 8.6 headline score the practical priority is moderate-to-low because Joomla administrators already hold broad database-level trust.
Authenticated Joomla backend users of any privilege level can bypass EasyStore's ACL checks and edit arbitrary records in versions 1.0.0 through 3.0.0. The allowEdit() method in ApiController.php is hardcoded to return true, defeating Joomla's component- and asset-level permission model (CWE-284). The vendor rates this high severity (CVSS 8.6), though our independent assessment confirms the attack requires an existing backend account and is not exploitable by unauthenticated visitors; no public exploit identified at time of analysis.
Unauthenticated PII harvesting in the JoomShaper Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows anyone to retrieve guest checkout records by submitting an email address to the checkout.searchGuestUser endpoint, which returns full name, phone number, street address, city, postal code and country directly from the #__easystore_guests table with no authentication, session validation or ownership check. Attackers can script the endpoint against purchased or scraped email lists to enumerate guest customers and compile sensitive personal data at scale, with no user interaction required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but the attack is trivially reachable; yield depends on email-list quality and on whether a given site has actually used guest checkout, since only matching guest emails return data.
Stored XSS in the Helix Ultimate Joomla extension (versions before 2.2.10) allows authenticated administrators to plant persistent malicious JavaScript through MegaMenu layout configuration fields, which subsequently executes in the browsers of all site visitors who load affected pages. Column and item configuration values within the MegaMenu layout JSON were persisted and rendered without complete contextual escaping, enabling injection of arbitrary HTML and script payloads. The vendor has released version 2.2.10 with stricter sanitization via Joomla's InputFilter and PHP's htmlspecialchars; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Unauthenticated local PHP file inclusion in the SP Page Builder extension for Joomla (versions before 6.8.0) lets remote attackers force the application to include and execute arbitrary PHP files already present on the server. Because included PHP is executed in the application context, this path-traversal flaw can escalate to remote code execution, and the CVSS 4.0 score of 9.2 reflects full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the SP Page Builder Joomla extension before version 6.7.1 allows remote attackers to extract sensitive database contents via the loadMoreArticles endpoint. The vulnerability stems from improper validation of the catid parameter, which can be manipulated to execute arbitrary SQL queries. No public exploit or active exploitation has been reported at this time.
SQL injection in the SP Page Builder extension for Joomla versions prior to 6.7.1 allows an authenticated attacker with high privileges to inject arbitrary SQL via the media manager’s search and date filter parameters. Exploitation can lead to unauthorized access to sensitive database contents, including data outside the extension’s scope. No public exploit or active exploitation has been confirmed at this time.
Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in all versions before 6.7.1, where a hardcoded, product-wide secret lets unauthenticated remote attackers forge the 'mail from' address of form submissions. Because the same secret ships across every deployment of the extension, any attacker who knows it can drive the server to send spoofed emails, enabling phishing and spam relayed through the trusted Joomla host. No public exploit code has been identified at time of analysis, EPSS risk is low (0.14%, 4th percentile), and CISA SSVC lists exploitation status as none.
Unauthenticated SQL injection in SP Page Builder for Joomla prior to version 6.7.1 allows remote attackers to extract sensitive data from the Joomla database via crafted order parameters in the Dynamic Content endpoint. The vulnerability, assigned CVE-2026-65766, has a CVSS 4.0 score of 9.2 but is not listed in CISA's KEV and has no known public exploits at time of analysis.
Authenticated arbitrary file deletion in SP Page Builder before 6.7.1 allows attackers with administrative access to Joomla to delete any file on the server via a path traversal flaw in the media manager. The vulnerability is not known to be actively exploited or have a public exploit, but the high CVSS score reflects the severe integrity impact once administrative privileges are obtained.
Unauthenticated order and payment forgery in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets remote attackers manipulate the payment and order state of arbitrary orders because critical fields such as order status and payment status are trusted from client-supplied input. An unauthenticated actor can mark unpaid orders as paid or otherwise tamper with order lifecycle states, undermining transaction integrity for any store using the extension. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 (high/critical) and network, no-auth, no-interaction vector make this a high-priority integrity flaw.
Unauthenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 2.0.1) by JoomShaper allows remote attackers to inject arbitrary SQL through improperly validated order parameters, yielding full read access to the backend database including credentials and active session tokens. No public exploit has been identified at time of analysis, but the flaw is trivially reachable over the network without authentication and against default installations. Successful exploitation enables complete disclosure of stored user data and hijacking of authenticated sessions.
Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.
Arbitrary file deletion in JoomShaper's Helix Ultimate template framework for Joomla allows unauthenticated remote attackers to delete files on the server due to a missing authorization check (CWE-862). Any anonymous user can reach the vulnerable functionality without credentials (PR:N/UI:N), enabling deletion of critical Joomla files to corrupt or take down the site. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored cross-site scripting in JoomShaper's Helix Ultimate template framework for Joomla lets unauthenticated attackers persist malicious JavaScript that executes in a victim's browser when the affected page is viewed. Because injection requires no authentication (PR:N) but relies on a victim rendering the poisoned content (UI:P), an attacker can hijack sessions, steal credentials, or perform actions as high-privilege administrators who visit the page. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Improper access control in the Helix3 template framework extension for Joomla (versions 1.0 through 3.1.1) exposes an AJAX handler task that lets remote unauthenticated attackers delete arbitrary files, write arbitrary JSON files, and modify template parameters. Because the handler performs no authentication or authorization check, an attacker can corrupt site configuration or destroy files without credentials. There is no public exploit identified at time of analysis, but the issue is automatable per CISA SSVC and carries a CVSS 7.5 (High) due to its network-reachable, unauthenticated integrity impact.
Reflected cross-site scripting (XSS) in the Dynamic Content Filter addon of the SP Page Builder Pro extension for Joomla (versions 3.0.0 through 5.6.1p2) allows unauthenticated attackers to inject arbitrary HTML or JavaScript into a victim's browser by crafting a URL with a malicious dc_filter_<fieldId> parameter, provided the addon is used with a slider field. The flaw is rated medium severity (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 base 5.3) and requires user interaction-the victim must load the crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list active exploitation.
Cross-site request forgery (CSRF) in the EasyStore extension for Joomla (versions 1.0.0 through 3.0.0) allows a remote unauthenticated attacker to trick a logged-in victim into submitting unauthorized product reviews or review spam via the product.addReview endpoint. The flaw stems from commented-out anti-CSRF token verification, and exploitation requires the victim to visit attacker-controlled content while authenticated. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to low integrity (unauthorized reviews) without confidentiality or availability loss.
CAPTCHA verification in SP Page Builder Pro's Contact, Opt-in, and Form Builder addons can be defeated on any Joomla site running versions 3.2.6 through 6.9.0 by submitting the parameter view_type=module alongside any non-empty token string. The addon silently discards the CAPTCHA plugin's actual onCheckAnswer verification result and substitutes a trivially-satisfied non-empty-string check whenever this attacker-controlled parameter is present, rendering all configured CAPTCHA types ineffective for forms placed inside SP Page Builder modules. No public exploit has been identified at time of analysis, but the bypass is trivially automatable per SSVC assessment, requiring only a single parameter change in a standard form POST.
Path traversal in JoomShaper's SP Property Joomla extension (all versions before 4.1.4) allows unauthenticated remote attackers to escape the intended gallery directory due to missing directory confinement checks in the gallery management controller tasks. The CVSS 4.0 vector (PR:N, UI:N, AV:N) confirms exploitation requires no privileges or user interaction, though impact is constrained to low-severity integrity and availability effects on both the vulnerable and subsequent systems with no confidentiality exposure. No public exploit or active exploitation has been identified at time of analysis.
SP Property, a Joomla real estate extension by joomshaper.com, allows unauthenticated remote attackers to redirect booking inquiry emails to arbitrary destinations by manipulating client-submitted hidden form fields that control recipient routing. Versions 1.0.0 through 4.1.3 are affected; vendor-released patch version 4.1.4 addresses the flaw by moving recipient resolution server-side. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication against any publicly accessible property booking form.
Open redirect in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows unauthenticated network-accessible attackers to craft redirect URLs that bypass the site's origin validation. The return parameter accepts arbitrary Base64-encoded strings without invoking Joomla's Uri::isInternal() check, meaning the decoded destination is never validated as belonging to the host site. An attacker can exploit this to redirect victims to attacker-controlled external domains, enabling highly convincing phishing campaigns that abuse the trusted appearance of the legitimate site URL. No active exploitation has been identified at time of analysis.
Unauthenticated comment creation in SP Page Builder for Joomla (versions prior to 6.8.0) allows remote attackers to bypass the disabled guest commenting restriction by supplying crafted user input that overrides the server-side access control setting. The vulnerability stems from improper access control (CWE-284), where a client-influenced parameter can override a site administrator's explicit configuration decision to disable public commenting. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 6.3 reflects limited integrity impact with no confidentiality or availability consequence.
Unauthenticated path traversal in SP Page Builder (Joomla extension by joomshaper.com) versions prior to 6.8.0 permits remote attackers to create arbitrary directories and write files with predefined names on the underlying server filesystem without any credentials. The CWE-22 root cause indicates the extension fails to sanitize user-supplied path segments before constructing filesystem paths. No public exploit code exists and no active exploitation has been confirmed at time of analysis, though the unauthenticated network vector with no user interaction requirement makes this accessible to opportunistic attackers.
Stored cross-site scripting in the Helix Ultimate template framework for Joomla (all versions below 2.2.11) lets an authenticated, low-privileged backend user persist script through the Media Picker that then executes in the browser of another user who views the affected page. The reporter (Joomla) rates it CVSS 4.0 8.6 High, while our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) scores it lower because exploitation needs a backend foothold plus victim interaction, and the practical impact scales with the privilege of whoever renders the payload - an administrator viewing the poisoned page is the worst case, equal- or lower-privileged users are far less damaging. It is prioritized for remediation this week; no public exploit code and no CISA KEV entry were identified at time of analysis.
Stored cross-site scripting in the Mega Menu Badge Text field of the Helix Ultimate template/framework for Joomla before version 2.2.11 lets an authenticated Joomla user with menu or template management privileges plant script that executes when another user - typically an administrator or editor - views a page or admin screen rendering the affected badge. The flaw is CWE-79 and applies only where the Mega Menu feature is actually in use with a badge configured on a menu item; our assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning privileged authoring access plus victim interaction rather than unauthenticated remote exploitation. No public exploit code or confirmed active exploitation was identified in the available sources; the vendor has released version 2.2.11 as the fixed release.
EasyStore for Joomla versions 1.0.0 through 3.0.0 does not enforce CSRF token verification across most administrator AJAX endpoints, enabling an attacker to trick a logged-in Joomla administrator into changing store data such as orders, coupons, media, customers, settings, tags, categories, reviews, and collections. Only the products() action checked tokens; the vendor fix moves verification into ApiController::execute() and applies Session::checkToken() to POST, PUT, PATCH, and DELETE requests. No public exploit code was identified at time of analysis, and exploitation requires an active admin session plus user interaction, so this is a moderate-risk CSRF issue despite the potential for high integrity and availability impact.
PII harvesting in JoomShaper EasyStore 1.0.0-3.0.0 allows unauthenticated attackers to enumerate guest checkout records via the checkout.searchGuestUser endpoint, which returns full shipping details (name, phone, address) for any supplied email address. Despite vendor labeling as an authenticated SQL injection, the endpoint requires no authentication or session validation and enables bulk collection of customer PII. No public exploit code has been identified at time of analysis; the vendor has resolved the issue by removing the server-side endpoint and migrating autofill to client-side localStorage.
CSRF in JoomShaper EasyStore for Joomla versions 1.0.0 through 3.0.0 allows an attacker to silently modify the core Joomla mail sender name and address (fromname, mailfrom) in configuration.php by tricking a logged-in administrator into visiting a malicious web page. The vulnerable endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration lacks anti-CSRF token validation and administrative authorization checks. Exploitation requires an authenticated admin session (UI:R) but no attacker credentials (PR:N); impact is limited to altering mail sender identity, and no public exploit was identified at time of analysis.
Authenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows a Joomla administrator to inject arbitrary SQL through the coupon bulk update task at administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate. The flaw is a genuine injection (reported as CWE-74, functionally classic CWE-89 SQLi) where coupon IDs are concatenated straight into raw SQL IN (...) clauses instead of being cast to integers or parameterized. Exploitation is confirmed to require high privilege (PR:H in the assessed CVSS:3.1 vector), and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.25% (14th percentile), so despite the 8.6 headline score the practical priority is moderate-to-low because Joomla administrators already hold broad database-level trust.
Authenticated Joomla backend users of any privilege level can bypass EasyStore's ACL checks and edit arbitrary records in versions 1.0.0 through 3.0.0. The allowEdit() method in ApiController.php is hardcoded to return true, defeating Joomla's component- and asset-level permission model (CWE-284). The vendor rates this high severity (CVSS 8.6), though our independent assessment confirms the attack requires an existing backend account and is not exploitable by unauthenticated visitors; no public exploit identified at time of analysis.
Unauthenticated PII harvesting in the JoomShaper Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows anyone to retrieve guest checkout records by submitting an email address to the checkout.searchGuestUser endpoint, which returns full name, phone number, street address, city, postal code and country directly from the #__easystore_guests table with no authentication, session validation or ownership check. Attackers can script the endpoint against purchased or scraped email lists to enumerate guest customers and compile sensitive personal data at scale, with no user interaction required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but the attack is trivially reachable; yield depends on email-list quality and on whether a given site has actually used guest checkout, since only matching guest emails return data.
Stored XSS in the Helix Ultimate Joomla extension (versions before 2.2.10) allows authenticated administrators to plant persistent malicious JavaScript through MegaMenu layout configuration fields, which subsequently executes in the browsers of all site visitors who load affected pages. Column and item configuration values within the MegaMenu layout JSON were persisted and rendered without complete contextual escaping, enabling injection of arbitrary HTML and script payloads. The vendor has released version 2.2.10 with stricter sanitization via Joomla's InputFilter and PHP's htmlspecialchars; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Unauthenticated local PHP file inclusion in the SP Page Builder extension for Joomla (versions before 6.8.0) lets remote attackers force the application to include and execute arbitrary PHP files already present on the server. Because included PHP is executed in the application context, this path-traversal flaw can escalate to remote code execution, and the CVSS 4.0 score of 9.2 reflects full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the SP Page Builder Joomla extension before version 6.7.1 allows remote attackers to extract sensitive database contents via the loadMoreArticles endpoint. The vulnerability stems from improper validation of the catid parameter, which can be manipulated to execute arbitrary SQL queries. No public exploit or active exploitation has been reported at this time.
SQL injection in the SP Page Builder extension for Joomla versions prior to 6.7.1 allows an authenticated attacker with high privileges to inject arbitrary SQL via the media manager’s search and date filter parameters. Exploitation can lead to unauthorized access to sensitive database contents, including data outside the extension’s scope. No public exploit or active exploitation has been confirmed at this time.
Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in all versions before 6.7.1, where a hardcoded, product-wide secret lets unauthenticated remote attackers forge the 'mail from' address of form submissions. Because the same secret ships across every deployment of the extension, any attacker who knows it can drive the server to send spoofed emails, enabling phishing and spam relayed through the trusted Joomla host. No public exploit code has been identified at time of analysis, EPSS risk is low (0.14%, 4th percentile), and CISA SSVC lists exploitation status as none.
Unauthenticated SQL injection in SP Page Builder for Joomla prior to version 6.7.1 allows remote attackers to extract sensitive data from the Joomla database via crafted order parameters in the Dynamic Content endpoint. The vulnerability, assigned CVE-2026-65766, has a CVSS 4.0 score of 9.2 but is not listed in CISA's KEV and has no known public exploits at time of analysis.
Authenticated arbitrary file deletion in SP Page Builder before 6.7.1 allows attackers with administrative access to Joomla to delete any file on the server via a path traversal flaw in the media manager. The vulnerability is not known to be actively exploited or have a public exploit, but the high CVSS score reflects the severe integrity impact once administrative privileges are obtained.
Unauthenticated order and payment forgery in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets remote attackers manipulate the payment and order state of arbitrary orders because critical fields such as order status and payment status are trusted from client-supplied input. An unauthenticated actor can mark unpaid orders as paid or otherwise tamper with order lifecycle states, undermining transaction integrity for any store using the extension. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 (high/critical) and network, no-auth, no-interaction vector make this a high-priority integrity flaw.
Unauthenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 2.0.1) by JoomShaper allows remote attackers to inject arbitrary SQL through improperly validated order parameters, yielding full read access to the backend database including credentials and active session tokens. No public exploit has been identified at time of analysis, but the flaw is trivially reachable over the network without authentication and against default installations. Successful exploitation enables complete disclosure of stored user data and hijacking of authenticated sessions.
Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.
Arbitrary file deletion in JoomShaper's Helix Ultimate template framework for Joomla allows unauthenticated remote attackers to delete files on the server due to a missing authorization check (CWE-862). Any anonymous user can reach the vulnerable functionality without credentials (PR:N/UI:N), enabling deletion of critical Joomla files to corrupt or take down the site. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored cross-site scripting in JoomShaper's Helix Ultimate template framework for Joomla lets unauthenticated attackers persist malicious JavaScript that executes in a victim's browser when the affected page is viewed. Because injection requires no authentication (PR:N) but relies on a victim rendering the poisoned content (UI:P), an attacker can hijack sessions, steal credentials, or perform actions as high-privilege administrators who visit the page. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Improper access control in the Helix3 template framework extension for Joomla (versions 1.0 through 3.1.1) exposes an AJAX handler task that lets remote unauthenticated attackers delete arbitrary files, write arbitrary JSON files, and modify template parameters. Because the handler performs no authentication or authorization check, an attacker can corrupt site configuration or destroy files without credentials. There is no public exploit identified at time of analysis, but the issue is automatable per CISA SSVC and carries a CVSS 7.5 (High) due to its network-reachable, unauthenticated integrity impact.
Reflected cross-site scripting (XSS) in the Dynamic Content Filter addon of the SP Page Builder Pro extension for Joomla (versions 3.0.0 through 5.6.1p2) allows unauthenticated attackers to inject arbitrary HTML or JavaScript into a victim's browser by crafting a URL with a malicious dc_filter_<fieldId> parameter, provided the addon is used with a slider field. The flaw is rated medium severity (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 base 5.3) and requires user interaction-the victim must load the crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list active exploitation.
Cross-site request forgery (CSRF) in the EasyStore extension for Joomla (versions 1.0.0 through 3.0.0) allows a remote unauthenticated attacker to trick a logged-in victim into submitting unauthorized product reviews or review spam via the product.addReview endpoint. The flaw stems from commented-out anti-CSRF token verification, and exploitation requires the victim to visit attacker-controlled content while authenticated. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to low integrity (unauthorized reviews) without confidentiality or availability loss.
CAPTCHA verification in SP Page Builder Pro's Contact, Opt-in, and Form Builder addons can be defeated on any Joomla site running versions 3.2.6 through 6.9.0 by submitting the parameter view_type=module alongside any non-empty token string. The addon silently discards the CAPTCHA plugin's actual onCheckAnswer verification result and substitutes a trivially-satisfied non-empty-string check whenever this attacker-controlled parameter is present, rendering all configured CAPTCHA types ineffective for forms placed inside SP Page Builder modules. No public exploit has been identified at time of analysis, but the bypass is trivially automatable per SSVC assessment, requiring only a single parameter change in a standard form POST.
Path traversal in JoomShaper's SP Property Joomla extension (all versions before 4.1.4) allows unauthenticated remote attackers to escape the intended gallery directory due to missing directory confinement checks in the gallery management controller tasks. The CVSS 4.0 vector (PR:N, UI:N, AV:N) confirms exploitation requires no privileges or user interaction, though impact is constrained to low-severity integrity and availability effects on both the vulnerable and subsequent systems with no confidentiality exposure. No public exploit or active exploitation has been identified at time of analysis.
SP Property, a Joomla real estate extension by joomshaper.com, allows unauthenticated remote attackers to redirect booking inquiry emails to arbitrary destinations by manipulating client-submitted hidden form fields that control recipient routing. Versions 1.0.0 through 4.1.3 are affected; vendor-released patch version 4.1.4 addresses the flaw by moving recipient resolution server-side. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication against any publicly accessible property booking form.
Open redirect in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows unauthenticated network-accessible attackers to craft redirect URLs that bypass the site's origin validation. The return parameter accepts arbitrary Base64-encoded strings without invoking Joomla's Uri::isInternal() check, meaning the decoded destination is never validated as belonging to the host site. An attacker can exploit this to redirect victims to attacker-controlled external domains, enabling highly convincing phishing campaigns that abuse the trusted appearance of the legitimate site URL. No active exploitation has been identified at time of analysis.
Unauthenticated comment creation in SP Page Builder for Joomla (versions prior to 6.8.0) allows remote attackers to bypass the disabled guest commenting restriction by supplying crafted user input that overrides the server-side access control setting. The vulnerability stems from improper access control (CWE-284), where a client-influenced parameter can override a site administrator's explicit configuration decision to disable public commenting. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 6.3 reflects limited integrity impact with no confidentiality or availability consequence.
Unauthenticated path traversal in SP Page Builder (Joomla extension by joomshaper.com) versions prior to 6.8.0 permits remote attackers to create arbitrary directories and write files with predefined names on the underlying server filesystem without any credentials. The CWE-22 root cause indicates the extension fails to sanitize user-supplied path segments before constructing filesystem paths. No public exploit code exists and no active exploitation has been confirmed at time of analysis, though the unauthenticated network vector with no user interaction requirement makes this accessible to opportunistic attackers.