Quix Page Builder security vulnerabilities

mySites.guru tracks 1vulnerability in com_quix. Every connected Joomla site is checked against it on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

What we check for

HighCVE-2026-580782026-07-15

Quix Page Builder (com_quix) below 6.2.2 - CVE-2026-58078 (CVSS 8.7) Unauthenticated SQL Injection (database read), Code Execution, Path Traversal and Stored XSS

Affected versions: ≥ 1.0.0 and < 6.2.2

What we have written about Quix Page Builder

Unauthenticated SQL Injection in Quix Page Builder found by mySites.guru

mySites.guru found and reported CVE-2026-58078, an unauthenticated SQL injection in Quix Page Builder for Joomla. An anonymous request to a front-end element endpoint could read the whole site database. Fixed in Quix 6.2.1; update to 6.2.2 now.

15 Jul 2026

Running Quix Page Builder on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

CVE identifiers: CVE-2026-58078. Rules current as of 24 August 2026.