DJ-HelpfulArticles 1.3 fixes a stored XSS anyone could plant in the admin overview

On 27 October 2026 DJ-Extensions published DJ-HelpfulArticles 1.3: Security Update, a security release for its free Joomla article-rating extension. The vendor rates the flaw High, classes it as stored cross-site scripting (CWE-79), and credits Ala Arfaoui with the report. No CVE has been assigned as of the day of release.

DJ-HelpfulArticles puts a one-click “was this helpful?” widget under an article, lets an unhappy reader leave a reason, and shows the administrator statistics on what was rated. The flaw sits where the two meet. Any visitor, with no account, could submit script through the rating widget, and that script could run in an administrator’s browser the next time they opened the overview. The post below is our reading of the vendor’s advisory, not of the code.

TL;DR

• The rating widget accepted a visitor IP address supplied by the browser and stored it without checking it was an IP address
• The value was escaped for the database but not for HTML, so the administrator’s “Helpful articles” overview printed it raw
• An unauthenticated visitor could plant JavaScript that ran with an administrator’s session when the overview was opened
• 1.3 fixes it: the IP now comes from the connection’s REMOTE_ADDR and is validated, and stored values in the overview are escaped before rendering
• Updating does not delete values already planted; the vendor’s FAQ says so
• The vendor names version 1.2. Versions 1.0.0 to 1.1.0 have a separate XSS, CVE-2024-27183, so every release below 1.3 has a known XSS of one kind or another
• This is DJ-Extensions’ fix. We score it 8.6 High on CVSS 4.0, in line with the vendor’s rating

How the DJ-HelpfulArticles rating widget trusted the wrong IP address

The widget records which visitor rated which article, and it used the visitor’s IP address to do that. Before 1.3, that IP address was part of the data the browser sent along with the rating. The server took the value as given and stored it, with no check that it was an IPv4 or IPv6 address, or an address at all. Anyone who can submit a rating can edit the request before it leaves their machine, so the “IP address” field was in practice a free-text field open to the public.

Storing it did no harm on its own, because the value was escaped on the way into the database. Where it went wrong was on the way out. The administrator’s “Helpful articles” overview displayed the stored IP without HTML escaping, so a value such as a script tag was written straight into the page and the browser ran it.

That is the classic stored XSS shape. Escaping for the database protects the SQL query from the value; escaping for HTML protects the page from it. Doing one does not do the other, so a string that was safe to store was dangerous to print.

The damage depends on who opens the page. Script running in a logged-in Joomla administrator’s browser has that administrator’s session, so it can do whatever the administrator can do through the browser: create a new Super User, install an extension, change a template file. The attacker does not need to log in. They submit one rating and wait for an administrator to look at the statistics, which is what the extension is for.

What changed in DJ-HelpfulArticles 1.3

DJ-Extensions describes the fix in two parts: where the IP address comes from, and how stored values are shown.

On the input side, all three AJAX handlers (helpful ratings, not-helpful ratings and feedback reasons) now read the visitor IP from the connection’s REMOTE_ADDR and validate it. The IP that the browser used to send in the request data is no longer used, and forwarded IP headers are ignored too. IP handling was removed from the widget JavaScript altogether, so a current rating request simply does not include one.

On the output side, the admin overview now escapes stored IP addresses, article titles, feedback reasons and displayed dates before rendering them. That last part is what makes the overview safe to open even when old records hold something nasty.

The vendor says its tests covered forged IP values, IPv4 and IPv6 addresses, invalid connection addresses, and safe rendering of stored malicious content. We have not tested the release ourselves and we are not publishing a payload.

Which DJ-HelpfulArticles versions are affected?

The advisory says to update every installation running version 1.2. It does not say whether versions before 1.2 share this flaw, so for 1.1.0 and earlier the answer is “unstated”.

It does not much matter, because those versions have a known XSS of their own. CVE-2024-27183, published on 9 July 2024 and rated Medium, is a separate cross-site scripting flaw in DJ-HelpfulArticles 1.0.0 to 1.1.0. Put the two together and every release below 1.3 has a published XSS of one kind or another. The fixed version is 1.3 for all of them.

What to do about DJ-HelpfulArticles on your Joomla sites

1. Update to 1.3. Download it from DJ-Extensions (it is free, but you need an account) or take it from the Joomla updater if your site offers it, then confirm the installed version under System, Manage, Extensions.
2. Check what was already stored. The vendor’s FAQ is clear that updating does not delete previously stored malicious values. Once you are on 1.3 the overview is escaped and safe to open, so open it and read down the IP column. Anything that is not an IP address was put there by hand. Remove those ratings and feedback records.
3. Check for what the script might have done. If any administrator opened the overview while the site was on 1.2 and a planted record was waiting, treat the admin session as possibly used. Look for administrator accounts you did not create and extensions you did not install. We have a walkthrough on finding rogue admin accounts in Joomla.
4. If you find either, the site has been compromised and the clean-up is bigger than this extension. Start with our Joomla hacked guide.

How mySites.guru flags DJ-HelpfulArticles

We added this flaw to the mySites.guru vulnerability database on 27 October 2026, so any connected Joomla site running DJ-HelpfulArticles 1.2 is flagged on its dashboard. Sites on 1.1.0 and below were already flagged for CVE-2024-27183, so the full range below 1.3 shows as vulnerable.

From there it is one job rather than a site-by-site hunt. The flagged sites can be updated in a batch with the mass updater, and the rogue admin check above runs on every connected site as part of the full audit, so a new Super User you did not create shows up in a report instead of in a client’s complaint. That is how we handle advisories across a portfolio of Joomla sites, and it is part of every subscription.

Why a visitor IP address is an XSS vector in more Joomla extensions than this one

DJ-HelpfulArticles is rare among the Joomla sites connected to mySites.guru: none of them currently run it. We are writing it up anyway, because the shape of the flaw is far more common than the extension.

An IP address only comes from one trustworthy place: the TCP connection, which PHP exposes as REMOTE_ADDR. Anything else, whether a field in the request body or a header like X-Forwarded-For, is written by the client and can say whatever the client likes. The one legitimate exception is a site behind a proxy it trusts, which may read the forwarded header, and then only from that proxy. An extension that reads the IP from the request body is reading attacker-controlled text and labelling it as a network fact, which is how a field no developer thought of as “input” ends up holding a script tag.

The second half of the pattern is just as common. Public AJAX endpoints that record something (a vote, a view, a form submission, a user agent) and then list those records to an administrator are everywhere in Joomla extensions, and they are exactly the surface we described in our post on AJAX endpoints as the CMS security blind spot. The visitor-facing side gets attention because it is visible. The admin list that displays what the visitor sent is an afterthought, and the escaping on it is the first thing to be missed. Any extension on your sites that stores a visitor IP or user agent and shows it in an admin screen deserves the same question this one has now answered.

DJ-Extensions has had a busy year on this front: in July 2026 it released a security update for DJ-Classifieds after we reported an unauthenticated file upload, a different class of flaw in a different product. Both times it published a security release post that said what changed, instead of an unannounced patch.

If you look after more than a handful of Joomla sites, knowing which of them run an extension named in an advisory is most of the job, and it is what a mySites.guru subscription is for.