CriticalCVE-2026-74254
Affected versions: ≥ 3.6.3 and < 3.6.4
Full advisory: our disclosure post
CVE-2026-74254Critical
Page Builder CK (com_pagebuilderck) 3.6.3 - SQL Injection in the styles model
Page Builder CK 3.6.3 is affected by SQL injection in its styles handling, tracked as CVE-2026-74254 and scored CVSS 4.0 9.3 Critical by the Joomla CNA with no privileges required. Style identifiers are interpolated into an SQL IN(...) clause with no escaping or integer casting. The vendor needed two releases to close it: 3.6.4 fixed the front-end vector, which is the one the CNA scored as requiring no privileges because it runs when a page is rendered, and 3.6.5 fixed the equivalent administrator vector. On 3.6.3 both vectors are open, so update to 3.6.5 and do not stop at 3.6.4. The same release also removes a reflected cross-site scripting flaw in the Page Builder CK editor plugin, which echoed a query string parameter into a hidden form field without escaping. Until you can update, restrict edit permissions on com_pagebuilderck to trusted users only, and review your Page Builder CK pages for unexpected content.
Affected versions: ≥ 3.6.3 and < 3.6.4
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Page Builder CK - Page Builder CK (com_pagebuilderck) 3.6.4 - SQL Injection in the styles model, backend vector still open
Page Builder CK 3.6.4 is still affected by CVE-2026-74254, the SQL injection in the styles handling, because that release only fixed half of it. The CNA records the whole issue as affecting versions 1.0.0 to 3.6.4 and scores it CVSS 4.0 9.3 Critical: 3.6.4 fixed the front-end vector, and 3.6.5 fixed the administrator one. On 3.6.4 specifically the remaining route is the administrator path, where the sanitising call discarded its own return value so the uncast style identifiers still reached the query, and reaching it needs an authenticated account with content editing rights on the component plus a valid session token. That is why this rule is scored lower than the 3.6.3 rule even though both carry the same CVE. Update to 3.6.5 or later, which applies the sanitising properly. Until you can update, restrict edit permissions on com_pagebuilderck to trusted users only.
Affected versions: ≥ 3.6.4 and < 3.6.5
Full advisory: our disclosure post
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.