CVE-2026-60026

HighCVSS 8.9

Published: 20/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

The Joomla extension Quix Page Builder Pro below version 6.2.1 allows an authenticated user with core.create/core.edit permissions to inject PHP code into element content. This code is executed via the include() function when the view is cached (caching is enabled by default).

Risk Assessment

An attacker can execute arbitrary PHP code on the server, leading to full compromise of the Joomla site and potentially the entire server.

Recommendation

Update the Quix Page Builder Pro extension to version 6.2.1 or later. Disable caching if an immediate update is not possible.

Other vulnerabilities in Quix Page Builder Pro

CVE-2026-58078High
The Joomla extension Quix Page Builder Pro versions below 6.2.1 is vulnerable to unauthenticated SQL injection. An attacker can send crafted queries without authentication.

Original NVD description (English source)

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user (core.create/core.edit) could inject PHP tags in element content, that got executed via view-cache include(). Requires caching on (default).