Stored XSS Vulnerability in Gridbox by Balbooa
CVE-2026-107903

8.6HIGH

Key Information:

Vendor

Balbooa.com

Status
Gridbox Extension For Joomla
Vendor
CVE Published:
5 November 2026

What is CVE-2026-107903?

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the Gridbox extension developed by Balbooa. This security flaw results from inconsistent sanitization of user input in the review section of the application, potentially allowing malicious users to inject and execute scripts on victim browsers when they view reviews. Users of Gridbox versions prior to 2.20.5.0 are particularly at risk. It is highly recommended that affected users update their applications immediately to mitigate this vulnerability and safeguard their web environments.

Affected Version(s)

Gridbox extension for Joomla 1.0.0-2.20.4.2

References

https://www.balbooa.com/gridbox
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.