10
CVEs
2
Critical
5
High
0
KEV
0
PoC
7
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
5
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-60034 | Stored and reflected cross-site scripting in ThemeXpert's JMedia media-manager extension for Joomla lets an attacker upload a malicious SVG file that, because it is served without an X-Content-Type-Options: nosniff header, is interpreted and executed as active script in the context of the site. There is no public exploit identified at time of analysis and the flaw is not on CISA KEV, but the attack is well-understood and trivially reproducible. The supplied CVSS 4.0 base score of 9.4 appears inflated for a script-injection issue, so treat the raw number with caution. | CRITICAL | 9.4 | 0.2% | 47 |
No patch
|
| CVE-2026-60032 | Authenticated arbitrary file upload in the ThemeXpert JMedia media-manager extension for Joomla lets an authenticated privileged user (PR:H) write executable files to the server and achieve remote code execution. Uploads accept executable content and polyglot filenames, and the extension's chmod handling fails to strip execute bits, so a planted file can be directly invoked by the web server. Rated CVSS 4.0 9.4 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.4 | 0.2% | 47 |
No patch
|
| CVE-2026-60026 | Authenticated PHP code execution in ThemeXpert's Quix Page Builder Pro extension for Joomla lets a privileged builder user (holding core.create or core.edit permissions) embed raw PHP tags in element content that are subsequently executed when the server's view-cache layer include()s the cached template. Exploitation requires caching to be enabled, which is the default, and yields full remote code execution on the underlying web server. No public exploit identified at time of analysis, though the reporter is Joomla itself and the CVSS 4.0 base score is 8.9 (High). | HIGH | 8.9 | 0.3% | 45 |
No patch
|
| CVE-2026-60027 | Arbitrary file disclosure in ThemeXpert's Quix Page Builder Pro extension for Joomla allows unauthenticated frontend users to read files outside the intended directory by supplying traversal sequences to a Form element on a published page. The flaw (CWE-22) carries a CVSS 4.0 base score of 8.7 driven by high confidentiality impact with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated nature makes it a strong candidate for opportunistic scanning. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-60030 | Improper access control in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets authenticated users upload media files even when they lack the media-management permission normally required for that action. The flaw is a permission-enforcement gap on the media upload function rather than a full unauthenticated compromise; no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor-assigned CVSS 4.0 base score is 8.7 (High), though the supplied vector conflicts with the 'authenticated users' language in the description. | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2026-58078 | SQL injection in the Quix Page Builder Pro extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through a crafted request, enabling database read and write against affected sites. The CVSS 4.0 base score is 8.7 (High), reflecting network vector, low complexity, no privileges, and high impact to confidentiality, integrity, and availability of the vulnerable database. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; a third-party disclosure write-up exists on mysites.guru. | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2026-60028 | Stored cross-site scripting in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets an authenticated builder-level user persist malicious scripts - including unsanitised SVG payloads - that then execute in the browser of any visitor or administrator who renders the affected page. Because the payload fires against higher-privileged admins, it enables session/account takeover of the Joomla back end. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | HIGH | 8.6 | 0.2% | 43 |
No patch
|
| CVE-2026-60031 | Information disclosure in the Quix Page Builder Pro Joomla extension exposes raw exception data to unauthenticated remote attackers via AJAX handler responses. The affected component fails to sanitize or suppress server-side exception output before returning it to the client, potentially leaking internal application state, file paths, database structure, or configuration details depending on what triggers the exception. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network-accessible attack vector lowers the barrier for reconnaissance abuse. | MEDIUM | 6.9 | 0.3% | 35 |
No patch
|
| CVE-2026-60029 | Stored cross-site scripting in Quix Page Builder Pro, a Joomla CMS extension by ThemeXpert, allows authenticated builder-role users to inject persistent malicious scripts by breaking out of id/class HTML attribute fields rendered in public-facing pages. The payload executes in the browsers of any visitor loading the affected page, enabling session hijacking, phishing redirects, or malware delivery at scale across the site's audience. No public exploit code or active exploitation has been identified at time of analysis, and no confirmed patched version is available from the provided references. | MEDIUM | 5.1 | 0.2% | 26 |
No patch
|
| CVE-2026-60033 | Server-Side Request Forgery in the JMedia Extension for Joomla (themexpert.com) allows authenticated administrators to direct the extension's remote-URL download feature to issue server-side HTTP requests to internal or reserved IP address ranges, effectively using the Joomla host as a network proxy. With high privilege required (PR:H per CVSS 4.0 vector) and no direct impact on the vulnerable system itself (VC/VI/VA all N), real-world risk is primarily limited to internal network reconnaissance and interaction with co-located services. No public exploit code and no CISA KEV listing exist at time of analysis. | MEDIUM | 5.1 | 0.2% | 26 |
No patch
|