CVE-2026-66494
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
An unauthenticated stored XSS vulnerability in SP Page Builder (< 6.7.0) for Joomla allows an attacker to store malicious JavaScript in the site's database via a single HTTP request. When an administrator opens the editor, the script executes automatically.
Risk Assessment
An attacker could hijack admin sessions, steal data, or infect the site, potentially leading to full compromise.
Recommendation
Update SP Page Builder to version 6.7.0 or later. Regularly review logs and monitor database integrity.
Other vulnerabilities in SP Page Builder
See all- CVE-2026-67285Critical
Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated arbitrary local PHP file inclusion vulnerability. An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.
- CVE-2026-65879Critical
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1. The hardcoded secret allowed attackers to forge the mail from address of forms.
- CVE-2026-65876Critical
Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated SQL injection vulnerability. Improper validation of catid parameters in the loadMoreArticles endpoint allows an attacker to execute SQL queries.
- CVE-2026-65766Critical
The SP Page Builder extension for Joomla versions below 6.7.1 contains an unauthenticated SQL injection vulnerability in the Dynamic Content endpoint due to improper validation of the order parameter.
- CVE-2026-48908CriticalActively exploited
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
- CVE-2026-67287Medium
In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create comments even when guest commenting is disabled by overriding the setting with user-supplied input.
- CVE-2026-67286Medium
In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create arbitrary directories and files with a predefined name.
- CVE-2026-65878High
The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 allows an authenticated user to delete arbitrary files due to improper path validation and ACL checks in the media manager.
- CVE-2026-65877High
The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 contains an SQL injection vulnerability in the search and date filters of the media manager, allowing an authenticated user to manipulate database queries.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..