Joomshaper Com
Monthly
Stored XSS in the Helix Ultimate Joomla extension (versions before 2.2.10) allows authenticated administrators to plant persistent malicious JavaScript through MegaMenu layout configuration fields, which subsequently executes in the browsers of all site visitors who load affected pages. Column and item configuration values within the MegaMenu layout JSON were persisted and rendered without complete contextual escaping, enabling injection of arbitrary HTML and script payloads. The vendor has released version 2.2.10 with stricter sanitization via Joomla's InputFilter and PHP's htmlspecialchars; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Unauthenticated local PHP file inclusion in the SP Page Builder extension for Joomla (versions before 6.8.0) lets remote attackers force the application to include and execute arbitrary PHP files already present on the server. Because included PHP is executed in the application context, this path-traversal flaw can escalate to remote code execution, and the CVSS 4.0 score of 9.2 reflects full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the SP Page Builder Joomla extension before version 6.7.1 allows remote attackers to extract sensitive database contents via the loadMoreArticles endpoint. The vulnerability stems from improper validation of the catid parameter, which can be manipulated to execute arbitrary SQL queries. No public exploit or active exploitation has been reported at this time.
SQL injection in the SP Page Builder extension for Joomla versions prior to 6.7.1 allows an authenticated attacker with high privileges to inject arbitrary SQL via the media manager’s search and date filter parameters. Exploitation can lead to unauthorized access to sensitive database contents, including data outside the extension’s scope. No public exploit or active exploitation has been confirmed at this time.
Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in all versions before 6.7.1, where a hardcoded, product-wide secret lets unauthenticated remote attackers forge the 'mail from' address of form submissions. Because the same secret ships across every deployment of the extension, any attacker who knows it can drive the server to send spoofed emails, enabling phishing and spam relayed through the trusted Joomla host. No public exploit code has been identified at time of analysis, EPSS risk is low (0.14%, 4th percentile), and CISA SSVC lists exploitation status as none.
Unauthenticated SQL injection in SP Page Builder for Joomla prior to version 6.7.1 allows remote attackers to extract sensitive data from the Joomla database via crafted order parameters in the Dynamic Content endpoint. The vulnerability, assigned CVE-2026-65766, has a CVSS 4.0 score of 9.2 but is not listed in CISA's KEV and has no known public exploits at time of analysis.
Authenticated arbitrary file deletion in SP Page Builder before 6.7.1 allows attackers with administrative access to Joomla to delete any file on the server via a path traversal flaw in the media manager. The vulnerability is not known to be actively exploited or have a public exploit, but the high CVSS score reflects the severe integrity impact once administrative privileges are obtained.
Unauthenticated order and payment forgery in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets remote attackers manipulate the payment and order state of arbitrary orders because critical fields such as order status and payment status are trusted from client-supplied input. An unauthenticated actor can mark unpaid orders as paid or otherwise tamper with order lifecycle states, undermining transaction integrity for any store using the extension. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 (high/critical) and network, no-auth, no-interaction vector make this a high-priority integrity flaw.
Unauthenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 2.0.1) by JoomShaper allows remote attackers to inject arbitrary SQL through improperly validated order parameters, yielding full read access to the backend database including credentials and active session tokens. No public exploit has been identified at time of analysis, but the flaw is trivially reachable over the network without authentication and against default installations. Successful exploitation enables complete disclosure of stored user data and hijacking of authenticated sessions.
Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.
Arbitrary file deletion in JoomShaper's Helix Ultimate template framework for Joomla allows unauthenticated remote attackers to delete files on the server due to a missing authorization check (CWE-862). Any anonymous user can reach the vulnerable functionality without credentials (PR:N/UI:N), enabling deletion of critical Joomla files to corrupt or take down the site. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored cross-site scripting in JoomShaper's Helix Ultimate template framework for Joomla lets unauthenticated attackers persist malicious JavaScript that executes in a victim's browser when the affected page is viewed. Because injection requires no authentication (PR:N) but relies on a victim rendering the poisoned content (UI:P), an attacker can hijack sessions, steal credentials, or perform actions as high-privilege administrators who visit the page. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Improper access control in the Helix3 template framework extension for Joomla (versions 1.0 through 3.1.1) exposes an AJAX handler task that lets remote unauthenticated attackers delete arbitrary files, write arbitrary JSON files, and modify template parameters. Because the handler performs no authentication or authorization check, an attacker can corrupt site configuration or destroy files without credentials. There is no public exploit identified at time of analysis, but the issue is automatable per CISA SSVC and carries a CVSS 7.5 (High) due to its network-reachable, unauthenticated integrity impact.
Path traversal in JoomShaper's SP Property Joomla extension (all versions before 4.1.4) allows unauthenticated remote attackers to escape the intended gallery directory due to missing directory confinement checks in the gallery management controller tasks. The CVSS 4.0 vector (PR:N, UI:N, AV:N) confirms exploitation requires no privileges or user interaction, though impact is constrained to low-severity integrity and availability effects on both the vulnerable and subsequent systems with no confidentiality exposure. No public exploit or active exploitation has been identified at time of analysis.
SP Property, a Joomla real estate extension by joomshaper.com, allows unauthenticated remote attackers to redirect booking inquiry emails to arbitrary destinations by manipulating client-submitted hidden form fields that control recipient routing. Versions 1.0.0 through 4.1.3 are affected; vendor-released patch version 4.1.4 addresses the flaw by moving recipient resolution server-side. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication against any publicly accessible property booking form.
Open redirect in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows unauthenticated network-accessible attackers to craft redirect URLs that bypass the site's origin validation. The return parameter accepts arbitrary Base64-encoded strings without invoking Joomla's Uri::isInternal() check, meaning the decoded destination is never validated as belonging to the host site. An attacker can exploit this to redirect victims to attacker-controlled external domains, enabling highly convincing phishing campaigns that abuse the trusted appearance of the legitimate site URL. No active exploitation has been identified at time of analysis.
Unauthenticated comment creation in SP Page Builder for Joomla (versions prior to 6.8.0) allows remote attackers to bypass the disabled guest commenting restriction by supplying crafted user input that overrides the server-side access control setting. The vulnerability stems from improper access control (CWE-284), where a client-influenced parameter can override a site administrator's explicit configuration decision to disable public commenting. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 6.3 reflects limited integrity impact with no confidentiality or availability consequence.
Unauthenticated path traversal in SP Page Builder (Joomla extension by joomshaper.com) versions prior to 6.8.0 permits remote attackers to create arbitrary directories and write files with predefined names on the underlying server filesystem without any credentials. The CWE-22 root cause indicates the extension fails to sanitize user-supplied path segments before constructing filesystem paths. No public exploit code exists and no active exploitation has been confirmed at time of analysis, though the unauthenticated network vector with no user interaction requirement makes this accessible to opportunistic attackers.
Stored XSS in the Helix Ultimate Joomla extension (versions before 2.2.10) allows authenticated administrators to plant persistent malicious JavaScript through MegaMenu layout configuration fields, which subsequently executes in the browsers of all site visitors who load affected pages. Column and item configuration values within the MegaMenu layout JSON were persisted and rendered without complete contextual escaping, enabling injection of arbitrary HTML and script payloads. The vendor has released version 2.2.10 with stricter sanitization via Joomla's InputFilter and PHP's htmlspecialchars; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Unauthenticated local PHP file inclusion in the SP Page Builder extension for Joomla (versions before 6.8.0) lets remote attackers force the application to include and execute arbitrary PHP files already present on the server. Because included PHP is executed in the application context, this path-traversal flaw can escalate to remote code execution, and the CVSS 4.0 score of 9.2 reflects full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the SP Page Builder Joomla extension before version 6.7.1 allows remote attackers to extract sensitive database contents via the loadMoreArticles endpoint. The vulnerability stems from improper validation of the catid parameter, which can be manipulated to execute arbitrary SQL queries. No public exploit or active exploitation has been reported at this time.
SQL injection in the SP Page Builder extension for Joomla versions prior to 6.7.1 allows an authenticated attacker with high privileges to inject arbitrary SQL via the media manager’s search and date filter parameters. Exploitation can lead to unauthorized access to sensitive database contents, including data outside the extension’s scope. No public exploit or active exploitation has been confirmed at this time.
Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in all versions before 6.7.1, where a hardcoded, product-wide secret lets unauthenticated remote attackers forge the 'mail from' address of form submissions. Because the same secret ships across every deployment of the extension, any attacker who knows it can drive the server to send spoofed emails, enabling phishing and spam relayed through the trusted Joomla host. No public exploit code has been identified at time of analysis, EPSS risk is low (0.14%, 4th percentile), and CISA SSVC lists exploitation status as none.
Unauthenticated SQL injection in SP Page Builder for Joomla prior to version 6.7.1 allows remote attackers to extract sensitive data from the Joomla database via crafted order parameters in the Dynamic Content endpoint. The vulnerability, assigned CVE-2026-65766, has a CVSS 4.0 score of 9.2 but is not listed in CISA's KEV and has no known public exploits at time of analysis.
Authenticated arbitrary file deletion in SP Page Builder before 6.7.1 allows attackers with administrative access to Joomla to delete any file on the server via a path traversal flaw in the media manager. The vulnerability is not known to be actively exploited or have a public exploit, but the high CVSS score reflects the severe integrity impact once administrative privileges are obtained.
Unauthenticated order and payment forgery in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets remote attackers manipulate the payment and order state of arbitrary orders because critical fields such as order status and payment status are trusted from client-supplied input. An unauthenticated actor can mark unpaid orders as paid or otherwise tamper with order lifecycle states, undermining transaction integrity for any store using the extension. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 (high/critical) and network, no-auth, no-interaction vector make this a high-priority integrity flaw.
Unauthenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 2.0.1) by JoomShaper allows remote attackers to inject arbitrary SQL through improperly validated order parameters, yielding full read access to the backend database including credentials and active session tokens. No public exploit has been identified at time of analysis, but the flaw is trivially reachable over the network without authentication and against default installations. Successful exploitation enables complete disclosure of stored user data and hijacking of authenticated sessions.
Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.
Arbitrary file deletion in JoomShaper's Helix Ultimate template framework for Joomla allows unauthenticated remote attackers to delete files on the server due to a missing authorization check (CWE-862). Any anonymous user can reach the vulnerable functionality without credentials (PR:N/UI:N), enabling deletion of critical Joomla files to corrupt or take down the site. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored cross-site scripting in JoomShaper's Helix Ultimate template framework for Joomla lets unauthenticated attackers persist malicious JavaScript that executes in a victim's browser when the affected page is viewed. Because injection requires no authentication (PR:N) but relies on a victim rendering the poisoned content (UI:P), an attacker can hijack sessions, steal credentials, or perform actions as high-privilege administrators who visit the page. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Improper access control in the Helix3 template framework extension for Joomla (versions 1.0 through 3.1.1) exposes an AJAX handler task that lets remote unauthenticated attackers delete arbitrary files, write arbitrary JSON files, and modify template parameters. Because the handler performs no authentication or authorization check, an attacker can corrupt site configuration or destroy files without credentials. There is no public exploit identified at time of analysis, but the issue is automatable per CISA SSVC and carries a CVSS 7.5 (High) due to its network-reachable, unauthenticated integrity impact.
Path traversal in JoomShaper's SP Property Joomla extension (all versions before 4.1.4) allows unauthenticated remote attackers to escape the intended gallery directory due to missing directory confinement checks in the gallery management controller tasks. The CVSS 4.0 vector (PR:N, UI:N, AV:N) confirms exploitation requires no privileges or user interaction, though impact is constrained to low-severity integrity and availability effects on both the vulnerable and subsequent systems with no confidentiality exposure. No public exploit or active exploitation has been identified at time of analysis.
SP Property, a Joomla real estate extension by joomshaper.com, allows unauthenticated remote attackers to redirect booking inquiry emails to arbitrary destinations by manipulating client-submitted hidden form fields that control recipient routing. Versions 1.0.0 through 4.1.3 are affected; vendor-released patch version 4.1.4 addresses the flaw by moving recipient resolution server-side. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication against any publicly accessible property booking form.
Open redirect in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows unauthenticated network-accessible attackers to craft redirect URLs that bypass the site's origin validation. The return parameter accepts arbitrary Base64-encoded strings without invoking Joomla's Uri::isInternal() check, meaning the decoded destination is never validated as belonging to the host site. An attacker can exploit this to redirect victims to attacker-controlled external domains, enabling highly convincing phishing campaigns that abuse the trusted appearance of the legitimate site URL. No active exploitation has been identified at time of analysis.
Unauthenticated comment creation in SP Page Builder for Joomla (versions prior to 6.8.0) allows remote attackers to bypass the disabled guest commenting restriction by supplying crafted user input that overrides the server-side access control setting. The vulnerability stems from improper access control (CWE-284), where a client-influenced parameter can override a site administrator's explicit configuration decision to disable public commenting. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 6.3 reflects limited integrity impact with no confidentiality or availability consequence.
Unauthenticated path traversal in SP Page Builder (Joomla extension by joomshaper.com) versions prior to 6.8.0 permits remote attackers to create arbitrary directories and write files with predefined names on the underlying server filesystem without any credentials. The CWE-22 root cause indicates the extension fails to sanitize user-supplied path segments before constructing filesystem paths. No public exploit code exists and no active exploitation has been confirmed at time of analysis, though the unauthenticated network vector with no user interaction requirement makes this accessible to opportunistic attackers.