4
CVEs
0
Critical
1
High
0
KEV
0
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78077 | Stored XSS in the Helix Ultimate Joomla extension (versions before 2.2.10) allows authenticated administrators to plant persistent malicious JavaScript through MegaMenu layout configuration fields, which subsequently executes in the browsers of all site visitors who load affected pages. Column and item configuration values within the MegaMenu layout JSON were persisted and rendered without complete contextual escaping, enabling injection of arbitrary HTML and script payloads. The vendor has released version 2.2.10 with stricter sanitization via Joomla's InputFilter and PHP's htmlspecialchars; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog. | HIGH | 8.6 | 0.3% | 43 |
No patch
|
| CVE-2026-78303 | SP Property, a Joomla real estate extension by joomshaper.com, allows unauthenticated remote attackers to redirect booking inquiry emails to arbitrary destinations by manipulating client-submitted hidden form fields that control recipient routing. Versions 1.0.0 through 4.1.3 are affected; vendor-released patch version 4.1.4 addresses the flaw by moving recipient resolution server-side. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication against any publicly accessible property booking form. | MEDIUM | 6.9 | 0.4% | 35 |
No patch
|
| CVE-2026-78085 | Path traversal in JoomShaper's SP Property Joomla extension (all versions before 4.1.4) allows unauthenticated remote attackers to escape the intended gallery directory due to missing directory confinement checks in the gallery management controller tasks. The CVSS 4.0 vector (PR:N, UI:N, AV:N) confirms exploitation requires no privileges or user interaction, though impact is constrained to low-severity integrity and availability effects on both the vulnerable and subsequent systems with no confidentiality exposure. No public exploit or active exploitation has been identified at time of analysis. | MEDIUM | 6.9 | 0.4% | 34 |
No patch
|
| CVE-2026-78079 | Open redirect in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows unauthenticated network-accessible attackers to craft redirect URLs that bypass the site's origin validation. The return parameter accepts arbitrary Base64-encoded strings without invoking Joomla's Uri::isInternal() check, meaning the decoded destination is never validated as belonging to the host site. An attacker can exploit this to redirect victims to attacker-controlled external domains, enabling highly convincing phishing campaigns that abuse the trusted appearance of the legitimate site URL. No active exploitation has been identified at time of analysis. | MEDIUM | 5.3 | 0.3% | 26 |
No patch
|