DJ-HelpfulArticles (com_djhelpfularticles) below 1.3 - Unauthenticated Stored XSS via the visitor IP field in the admin overview (CVE-2026-102800)
DJ-HelpfulArticles 1.2 has an unauthenticated stored cross-site scripting flaw (CWE-79) in its article rating feature. The rating widget sent the visitor IP address from the browser, and the component stored it without checking it was a valid IP. It was escaped for the database but not when shown in the administrator "Helpful articles" overview, so an anonymous visitor could submit JavaScript in that field and have it run in an administrator's browser when they opened the overview. DJ-Extensions rate it High. Fixed in 1.3, which takes the IP from the server connection (REMOTE_ADDR) and validates it in all three rating and feedback handlers, and escapes stored IPs, article titles, feedback reasons and dates in the overview. Update to 1.3 or later. Updating does not delete records already stored, it only stops them running; if the site was exposed, review and clear old rating and feedback rows. No CVE has been assigned at the time of writing.
Affected versions: ≥ 1.0.0 and < 1.3
Full advisory: our disclosure post