CVE-2026-105602HighCVSS 8.6CVE published 2 November 2026Added to mySites.guru 29 October 2026

Helix Ultimate Framework (helixultimate) 2.2.10 - Authenticated Stored XSS and Hardening Fixes

Q: Which versions are affected by CVE-2026-105602?

CVE-2026-105602 is covered by 2 rules: Helix Ultimate Framework from 2.2.10 up to but not including 2.2.11; Helix Ultimate from 2.2.10 up to but not including 2.2.11.

Q: How do I fix CVE-2026-105602?

It depends on the extension and release line your site runs. For Helix Ultimate Framework from 2.2.10 up to but not including 2.2.11: update Helix Ultimate Framework to 2.2.11 or later. For Helix Ultimate from 2.2.10 up to but not including 2.2.11: update Helix Ultimate to 2.2.11 or later.

Q: How severe is CVE-2026-105602?

Joomla CNA scores it 8.6 (High) under CVSS 4.0. In plain terms: reachable across the internet, any logged-in account will do and someone has to visit a page.

JoomShaper released Helix Ultimate 2.2.11 on 29 October 2026 as a security update, grading it Moderate (CVSS about 6.5) and stating 2.0.0 to 2.2.10 are affected. Versions below 2.2.10 are already covered by the earlier Helix Ultimate rules; this row covers 2.2.10. The most significant fix: the 2.2.10 blog audio/video embed sanitiser (Helper::sanitizeEmbed) passed its allowed iframe/audio/video tag and attribute lists to Joomla InputFilter in blacklist mode, so the list meant to be the only tags allowed was the list removed, weakening the 2.2.10 stored XSS fix for embed inputs. 2.2.11 switches it to a strict allow-list. Also fixed: escaping of file and folder names, paths and breadcrumbs in the framework media picker (XSS), regex validation of the error page preset name (path traversal in a stylesheet path), Mega Menu badge sanitisation, and a tighter check that Blog image removal only touches images the article actually references. Every fix requires a logged-in user with edit rights; nothing unauthenticated. Published as CVE-2026-105602 (Mega Menu badge text stored XSS) and CVE-2026-103419 (media picker stored XSS) on 2 Nov 2026, both CVSS 4.0 8.6 High. Update the System - Helix Ultimate Framework plugin to 2.2.11 or later. The Helix Ultimate TEMPLATE (shaper_helixultimate) is a separate install with its own entry in Joomla Updates, and must be updated as well.

Is my site affected?

CVE-2026-105602 is checked by 2 rules. Find the extension and release line your site runs:

Extension	Affected versions	Fixed in	What to do
Helix Ultimate Framework	from 2.2.10 up to but not including 2.2.11	2.2.11	Update Helix Ultimate Framework to 2.2.11 or later.
Helix Ultimate	from 2.2.10 up to but not including 2.2.11	2.2.11	Update Helix Ultimate to 2.2.11 or later.

Check whether your sites are affected

How CVE-2026-105602 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

8.6 High

CVSS 4.0, scored by Joomla CNA

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

How it is reached

AV:N Attack vector: Network. Reachable across the internet
AC:L Attack complexity: Low. Nothing to work around, it just works
AT:N Attack requirements: None. Works against any affected install
PR:L Privileges required: Low. Any logged-in account will do
UI:P User interaction: Passive. Someone has to visit a page

What it does to the site

VC:H Confidentiality: High. Everything the site holds can be read
VI:H Integrity: High. Data and files can be altered at will
VA:L Availability: Low. The site slows or stutters

What it does beyond the site

SC:N Confidentiality: None. Other systems keep their data
SI:N Integrity: None. Other systems keep their integrity
SA:N Availability: None. Other systems stay up

Timeline

29 October 2026mySites.guru check added for Helix Ultimate Framework (from 2.2.10 up to but not including 2.2.11)
29 October 2026mySites.guru check added for Helix Ultimate (from 2.2.10 up to but not including 2.2.11)
29 October 2026We published: Helix Ultimate 2.2.11 Is a Security Release. Now Its Download Page Says So.
2 November 2026CVE-2026-105602 record published by its CNA

Rule details

HighCVE-2026-103419 CVE-2026-105602 CVE-2026-780772026-10-29

Helix Ultimate Framework

Affected versions: ≥ 2.2.10 and < 2.2.11

Full advisory: our disclosure post

HighCVE-2026-103419 CVE-2026-105602 CVE-2026-780772026-10-29

Helix Ultimate - Helix Ultimate (shaper_helixultimate) 2.2.10 - Authenticated Stored XSS and Hardening Fixes

JoomShaper released Helix Ultimate 2.2.11 on 29 October 2026 as a security update, grading it Moderate (CVSS about 6.5) and stating 2.0.0 to 2.2.10 are affected. THIS ROW IS THE TEMPLATE (shaper_helixultimate), which is installed separately from the System - Helix Ultimate Framework plugin and is listed as its own update in Joomla Updates (System, Update, Extensions) - updating the plugin alone does not clear it. Template-side fixes in 2.2.11: the error page now validates the preset stylesheet name against /^[A-Za-z0-9_-]+$/ (path traversal into the stylesheet path), and article rating now checks the rating is 1 to 5 and the article is published. The framework plugin half of this release fixes the embed sanitiser that ran in blacklist mode in 2.2.10, media picker escaping and Mega Menu badge sanitisation. Every fix requires a logged-in user with edit rights; nothing unauthenticated. Published as CVE-2026-105602 (Mega Menu badge text stored XSS) and CVE-2026-103419 (media picker stored XSS) on 2 Nov 2026, both CVSS 4.0 8.6 High. Update the template to 2.2.11 through Joomla Updates, or install the 2.2.11 Template package from JoomShaper.

Affected versions: ≥ 2.2.10 and < 2.2.11

Full advisory: our disclosure post

Our disclosure post

Helix Ultimate 2.2.11 Is a Security Release. Now Its Download Page Says So.

Helix Ultimate 2.2.11 fixes stored XSS issues scored 8.6 High in every version up to 2.2.10. What changed, and how to update both halves.

29 Oct 2026

Other vulnerabilities in Helix Ultimate Framework and Helix Ultimate

Updating for CVE-2026-105602 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.