Stored XSS Vulnerability in Balbooa Gallery for Joomla
CVE-2025-49486

8.6HIGH

Key Information:

Vendor

Balbooa.com

Status
Balbooa Gallery Component For Joomla
Vendor
CVE Published:
18 July 2025

What is CVE-2025-49486?

The Balbooa Gallery plugin for Joomla is susceptible to a stored Cross-Site Scripting (XSS) vulnerability. This flaw allows authenticated users to embed malicious scripts within gallery items. When these items are viewed by other users, the injected scripts can execute in their browsers, potentially compromising user data and leading to unauthorized actions.

Affected Version(s)

Balbooa Gallery component for Joomla 1.0.0-2.4.0

References

https://extensions.joomla.org/extension/gallery/
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kamil Szczurowski
Robert Kruczek
.
CVE-2025-49486 : Stored XSS Vulnerability in Balbooa Gallery for Joomla