Stored XSS Vulnerability in Joomla Extension by tassos.gr
CVE-2026-115452

7.5HIGH

Key Information:

Vendor

Tassos.gr

Status
Advanced Custom Fields Extension For Joomla
Smile Pack Extension For Joomla
Vendor
CVE Published:
5 November 2026

What is CVE-2026-115452?

A stored Cross-Site Scripting (XSS) vulnerability exists in the Joomla Extension provided by tassos.gr. This flaw allows an attacker with editor privileges to insert malicious scripts into Map marker labels. When other users view these markers, the scripts execute in their browsers, potentially compromising their session or data. The affected versions include Advanced Custom Fields from 2.8.2 to 3.1.8, and Smile Pack from 1.1.2 to 2.1.6, emphasizing the need for users to apply necessary patches and monitor their installations.

Affected Version(s)

Advanced Custom Fields extension for Joomla 3.0.0-3.1.8

Advanced Custom Fields extension for Joomla 2.8.2-2.8.15

Smile Pack extension for Joomla 2.0.0-2.1.6

References

https://www.tassos.gr/
product

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.