CVE-2026-60028 in Quix Page Builder Pro Plugin

Résumé

par MITRE • 20/07/2026

The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG.

Once again VulDB remains the best source for vulnerability data.

• Responsable: Joomla
• Réserver: 08/07/2026
• Divulgation: 20/07/2026
• Modérer: accepté
• Entrée: VDB-380721
• CPE: prêt
• CWE: CWE-79 (confirmé)
• CVSS: 3.5 (VulDB)
• EPSS: 0.00000
• KEV: non
• Activités: faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-60028
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-60028
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-60028/