CVE-2026-66494 in SP Page Builder Extension
Summary
by MITRE • 08/07/2026
Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/08/2026
This vulnerability exists within the SP Page Builder extension for Joomla CMS, specifically affecting versions prior to 6.7.0 and hosted on joomshaper.com. The flaw represents a critical stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript code into the target website's database through a single HTTP request. The vulnerability occurs within the Shapes API endpoint of the SP Page Builder component, which fails to properly sanitize user input before storing it in the database. When an administrator subsequently opens the SP Page Builder editor interface, the stored malicious script executes automatically in their browser context, creating a persistent XSS attack vector that can compromise administrative sessions.
The technical implementation of this vulnerability leverages the lack of proper input validation and output escaping mechanisms within the Shapes API endpoint. Attackers can craft malicious payloads through HTTP requests that bypass standard security controls, allowing JavaScript code to be stored in database fields that are later rendered in the administrator's browser interface. This represents a classic stored XSS scenario where the malicious payload persists on the server and executes whenever authorized users interact with the vulnerable component. The vulnerability directly maps to CWE-79 - Cross-site Scripting and aligns with ATT&CK technique T1566.001 - Phishing via Service Provider, as it enables attackers to compromise administrator accounts through automated injection attacks.
The operational impact of this vulnerability is severe for Joomla sites running affected versions of SP Page Builder. Administrative sessions can be hijacked, allowing attackers to gain full control over the website's content management system. The stored XSS payload could potentially steal session cookies, redirect administrators to malicious sites, or execute additional attacks such as credential theft through keylogging scripts. Given that SP Page Builder is a popular page building component, this vulnerability affects numerous Joomla installations and represents a significant risk to website owners who may not immediately detect the compromise. The attack requires no authentication from the attacker's perspective, making it particularly dangerous for high-privilege targets.
Organizations should immediately upgrade to SP Page Builder version 6.7.0 or later to remediate this vulnerability, as no effective workarounds exist for this specific XSS flaw. Administrators should implement additional security measures including web application firewalls that can detect and block malicious payloads targeting the Shapes API endpoint, regular monitoring of database content for suspicious injections, and enhanced session management practices. Network segmentation and privilege separation can help limit the damage if an attacker successfully exploits this vulnerability, while regular security audits of third-party extensions should be conducted to identify similar vulnerabilities in other components. Security teams should also monitor for indicators of compromise related to this specific attack vector, including unusual database modifications or unexpected administrator activity patterns that might suggest exploitation attempts.