Unauthenticated Stored XSS in Gridbox by Balbooa
CVE-2026-105607

8.6HIGH

Key Information:

Vendor

Balbooa.com

Status
Gridbox Extension For Joomla
Vendor
CVE Published:
5 November 2026

What is CVE-2026-105607?

The Gridbox extension by Balbooa is susceptible to an unauthenticated stored cross-site scripting (XSS) vulnerability, specifically in the 'Recent Comments / Recent Reviews' widget. This flaw allows an attacker to inject malicious scripts into the site, which can compromise user data and facilitate further exploitation. Versions prior to 2.20.5.0 are affected, emphasizing the need for users to update to newer, secure versions to safeguard their applications from potential attacks.

Affected Version(s)

Gridbox extension for Joomla 1.0.0-2.20.4.2

References

https://www.balbooa.com/gridbox
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.