Back to overview

CVE-2026-60028

HIGH
8.6
CVSS 4.0
Description
The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG.

Metadata

CVE ID
CVE-2026-60028
State
PUBLISHED
Assigner
Joomla
Reserved
2026-07-08 05:31 UTC
Published
2026-07-20 18:09 UTC
Last updated
2026-07-21 05:33 UTC
Primary CWE
CWE-79
CWE-79 Improper Neutralization of Input During Web Page Gene…
Vendor / Product
themexpert.com / Quix Page Builder Pro extension for Joomla
Sources
cve.org  ·  NVD

Severity & Metrics

8.6 HIGH CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
themexpert.com Quix Page Builder Pro extension for Joomla — 1.0-6.2.0
Weakness (CWE)
CWESourceDescription
CWE-79 cna CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.6 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (1)
Back to overview