Unauthenticated Stored XSS Vulnerability in DJ-HelpfulArticles Extension for Joomla

CVE-2026-102800

What is CVE-2026-102800?

The DJ-HelpfulArticles extension for Joomla allows unauthenticated users to exploit a stored XSS vulnerability through a voting widget. Specifically, this occurs when the widget submits a user-provided IP address to multiple AJAX handlers without proper authentication. The IP address is stored unfiltered, leading to potential XSS attacks when rendered in the backend overview. Additionally, the absence of CSRF tokens and rate limiting further exacerbates the security flaw, allowing attackers to execute malicious scripts that could compromise the integrity of the application.

References