What’s Vulnerable › Vulnerabilities
CVE-2026-102426: Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-05 · updated 2026-10-14
- Weakness: CWE-79
Description
Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value.
Affected products
- joomshaper.com SP Page Builder (Pro) extension for Joomla: from 3.0.0 before 5.6.1; 5.6.1 — fixed in 5.6.1
How to fix
Upgrade to a fixed version: joomshaper.com SP Page Builder (Pro) extension for Joomla 5.6.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-102426 or the next vulnerability affects your stack