XSS
11 articles tagged XSS, newest first.
Kunena 7.1.1 and 6.4.17 Fix Stored XSS and Open Member Data in the Joomla Forum Extension
Kunena 7.1.1 and 6.4.17 are security releases for the Joomla forum extension. Both fix stored XSS in posts, and only 7.1.1 closes open member data lists.
Tassos ACF and Smile Pack for Joomla Fix Two CVEs: a Map XSS and Gallery Image Deletion
Tassos ACF and Smile Pack for Joomla fix Map XSS CVE-2026-115452 (7.5 High) and Gallery deletion CVE-2026-115451 (6.9). Update to 3.1.9/2.8.16, 2.1.7/1.2.10.
Gridbox 2.20.5.0 Fixes Unauthenticated File Deletion and Stored XSS
Gridbox 2.20.5.0 fixes four flaws in the Joomla extension, including file deletion that needs no login. About 92% of the Gridbox sites we monitor are affected.
DJ-HelpfulArticles 1.3 fixes a stored XSS anyone could plant in the admin overview
DJ-HelpfulArticles 1.3 fixes CVE-2026-102800, a stored XSS in the Joomla rating widget: a visitor-supplied IP was saved unchecked and shown to admins.
Vik Booking 1.18.19 is its third security release in a week, with fixes for Vik Rent Car and Vik Rent Items
Vik Booking 1.18.19, Vik Rent Car 1.15.13 and Vik Rent Items 1.8.6 fix a CSRF gap and stored XSS. Three Vik Booking security releases in a week. What changed.
Phoca Gallery 6.1.6 fixes a stored XSS hidden in a photo's EXIF data
Phoca Gallery 4.5.0 to 6.1.5 lets a crafted image's EXIF data run script on the photo info view. 6.1.6 fixes it on Joomla 6 only; Joomla 4 and 5 are stranded.
JCH Optimize 9.4.0 Fixes Six High-Rated Security Issues in the Joomla Extension
JCH Optimize 9.4.0 fixed an XSS, an unauthenticated hit counter flaw and missing admin CSRF checks; 9.4.2 fixes a file read and an SSRF. Update to 9.4.2.
SP Page Builder's Joomla 3 Security Patch Was Incomplete. Version 1.0.3 Fixes It.
JoomShaper's first Joomla 3 security patch for SP Page Builder left the captcha bypass live and the XSS fix incomplete. Version 1.0.3 closes both.
Three OrdaSoft Joomla Extensions Have Unauthenticated SQL Injections in Their Sort Order
Real Estate Manager, Vehicle Manager and Book Library for Joomla each have an SQL injection needing no login and a reflected XSS. Six CVEs and their fixes.
DPCalendar 10.12.0 fixes an SQL injection and an XSS
Digital Peak fixed a blind SQL injection and a stored XSS in DPCalendar 10.12.0, backported to 8.19.5 for Joomla 3. Both need a logged-in user.
Helix Ultimate 2.2.7 Closes an Unauthenticated Menu Write
Helix Ultimate 2.2.7 fixes CSRF and permission gaps in com_ajax: an unauthenticated menu write leading to stored XSS, a file delete, and an open redirect.