CVE-2026-66494 in SP Page Builder Extension

Riassunto

di MITRE • 07/08/2026

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsabile: Joomla
• Prenotare: 27/07/2026
• Divulgazione: 07/08/2026
• Moderazione: accettato
• Voce: VDB-387005
• CPE: pronto
• CWE: CWE-79 (confermato)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Attività: basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-66494
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-66494
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-66494/