CVE-2026-102800HighCVSS 8.7CVE published 27 October 2026Added to mySites.guru 27 October 2026

DJ-HelpfulArticles (com_djhelpfularticles) below 1.3 - Unauthenticated Stored XSS via the visitor IP field in the admin overview

Q: Which versions are affected by CVE-2026-102800?

CVE-2026-102800 affects DJ-HelpfulArticles from 1.0.0 up to but not including 1.3. The fix is in 1.3.

Q: How do I fix CVE-2026-102800?

Update DJ-HelpfulArticles to 1.3 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.

Q: How severe is CVE-2026-102800?

Joomla CNA scores it 8.7 (High) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and someone has to visit a page.

DJ-HelpfulArticles 1.2 has an unauthenticated stored cross-site scripting flaw (CWE-79) in its article rating feature. The rating widget sent the visitor IP address from the browser, and the component stored it without checking it was a valid IP. It was escaped for the database but not when shown in the administrator "Helpful articles" overview, so an anonymous visitor could submit JavaScript in that field and have it run in an administrator's browser when they opened the overview. DJ-Extensions rate it High. Fixed in 1.3, which takes the IP from the server connection (REMOTE_ADDR) and validates it in all three rating and feedback handlers, and escapes stored IPs, article titles, feedback reasons and dates in the overview. Update to 1.3 or later. Updating does not delete records already stored, it only stops them running; if the site was exposed, review and clear old rating and feedback rows. No CVE has been assigned at the time of writing.

Is my site affected?

Affected: DJ-HelpfulArticles from 1.0.0 up to but not including 1.3
Fixed in: 1.3
What to do: Update DJ-HelpfulArticles to 1.3 or later.

Check whether your sites are affected

How CVE-2026-102800 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

8.7 High

CVSS 4.0, scored by Joomla CNA

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

How it is reached

AV:N Attack vector: Network. Reachable across the internet
AC:L Attack complexity: Low. Nothing to work around, it just works
AT:N Attack requirements: None. Works against any affected install
PR:N Privileges required: None. No account needed
UI:P User interaction: Passive. Someone has to visit a page

What it does to the site

VC:H Confidentiality: High. Everything the site holds can be read
VI:H Integrity: High. Data and files can be altered at will
VA:H Availability: High. The site can be taken down

What it does beyond the site

SC:N Confidentiality: None. Other systems keep their data
SI:N Integrity: None. Other systems keep their integrity
SA:N Availability: None. Other systems stay up

Timeline

27 October 2026CVE-2026-102800 record published by its CNA
27 October 2026mySites.guru check added for DJ-HelpfulArticles (from 1.0.0 up to but not including 1.3)
27 October 2026We published: DJ-HelpfulArticles 1.3 fixes a stored XSS anyone could plant in the admin overview

Rule details

HighCVE-2026-1028002026-10-27

DJ-HelpfulArticles

Affected versions: ≥ 1.0.0 and < 1.3

Full advisory: our disclosure post

Our disclosure post

DJ-HelpfulArticles 1.3 fixes a stored XSS anyone could plant in the admin overview

DJ-HelpfulArticles 1.3 fixes CVE-2026-102800, a stored XSS in the Joomla rating widget: a visitor-supplied IP was saved unchecked and shown to admins.

27 Oct 2026

Other vulnerabilities in DJ-HelpfulArticles

Updating for CVE-2026-102800 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.