CVE-2026-102426
MediumCVSS 5.3Summary
In the Dynamic Content Filter addon in SP Page Builder Pro versions 3.0.0–5.6.1p2, there is reflected XSS. The slider minimum and maximum values are taken from the dc_filter_<fieldId> parameter, split on "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content.
Risk Assessment
An unauthenticated attacker can inject arbitrary HTML or JavaScript into the rendered page, potentially leading to session theft or other browser-based attacks on the victim.
Recommendation
Update SP Page Builder Pro to a version later than 5.6.1p2 that fixes the reflected XSS vulnerability.
Other vulnerabilities in SP Page Builder Pro
See all- CVE-2026-79701Medium
Joomla extension SP Page Builder Pro contains a vulnerability that allows bypassing CAPTCHA in Contact, Opt-in and Form Builder addons. An attacker can send a request with view_type=module and any token, causing CAPTCHA verification to be skipped.
- CVE-2026-79700Medium
In the SP Page Builder Pro extension (versions 5.1.4 - 6.9.0), the optin_form addon read the CAPTCHA type, expected answer, and enabled flag from the request rather than from the stored addon configuration. Verification reduced to md5($captcha_question) != $captcha_answer with both operands supplied by the attacker, allowing unauthenticated CAPTCHA bypass.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS