Unauthenticated Stored XSS in SP Page Builder by Joomla Extension

CVE-2026-66494

What is CVE-2026-66494?

The SP Page Builder, developed by JoomShaper, is susceptible to an unauthenticated stored XSS vulnerability that allows attackers to inject malicious JavaScript code into the Joomla site's database. This injection can be executed through a single HTTP request, leading to potentially serious consequences when an administrator accesses the SP Page Builder editor. The JavaScript runs automatically in the administrator's browser, creating opportunities for data theft, session hijacking, or further exploitation of the website.

References