Read the docs
TI-2026-81122 Aliases CVE-2026-102800GHSA-q7p6-hg4g-4wgq

Stored cross-site scripting in DJ-HelpfulArticles Joomla extension

Priority MEDIUM 46CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The DJ-HelpfulArticles extension for Joomla before 1.3.0 contains a stored cross-site scripting flaw (CWE-79). The article voting widget stores a client-supplied ip value without taking it from the connection, and the administrator backend prints it without output escaping. An unauthenticated remote attacker can submit a crafted value through com_ajax that runs script when an administrator views the Helpful articles overview.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field to its AJAX handlers (getDeny, getConfirm, getDenyReason in mod_djhelpful_articles/helper.php), reachable without authentication through com_ajax. The value was stored exactly as submitted instead of being taken from the connection by the server. It was then printed without output escaping in the administrator backend’s “Helpful articles” overview (views/items/tmpl/default.php). $db->quote() was applied on insert, which protects the SQL statement but does nothing for HTML output. There was no CSRF token, no rate limit, and the vote de-duplication keyed on the same attacker-controlled field.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dj-extensions.comDJ-HelpfulArticles extension for Joomla1.0.0-1.2.0—No fix listedCNA
  • DJ-HelpfulArticles extension for Joomla Vendordj-extensions.com Affected 1.0.0-1.2.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for DJ-HelpfulArticles extension for Joomla.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-102800
  2. 2026-10-27 Alias added: GHSA-q7p6-hg4g-4wgq
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-04 CISA SSVC decision points changed
  5. 2026-11-04 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2026-44289 Unrestricted file upload in dj-extensions.com jDownloads extension for Joomla CVSS 4.0CRITICAL 10.0
  • TI-2026-44029 Unrestricted file upload in dj-extensions.com DJ-Classifieds extension for Joomla CVSS 4.0CRITICAL 10.0
  • TI-2026-83930 Unauthenticated SQL injection in DJ-Classifieds Joomla extension CVSS 4.0CRITICAL 9.3
  • TI-2025-32030 Extension - dj-extensions.com - SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla CVSS 4.0HIGH 8.5
  • TI-2026-83929 Arbitrary file upload in Joomla extension DJ-Classifieds CVSS 4.0CRITICAL 9.4
  • TI-2025-34271 Extension - dj-extensions.com - SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla CVSS 4.0HIGH 8.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences