CVE-2026-66494CWE-284CWE-79broken-access-controlcross-site-scripting

CVE-2026-66494

published August 7, 2026

CVSS
8.7
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00498 · 41.8th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-07T17:16Z
References (1)
https://www.joomshaper.com/page-builder · [email protected]
EPSS history
Timeline
  • 07 AUG 12:57Z
    Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0
    cvelistv5