TI-2026-83812 Aliases CVE-2026-103419 GHSA-69vr-gf5m-pw3v

Stored cross-site scripting in Helix Ultimate extension for Joomla

LOW 39CWE-79Published 2026-11-02 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Helix Ultimate extension for Joomla from joomshaper.com is affected before 2.2.11. Improper neutralization of input in the Media Picker stores script content that runs in other users' browsers (CWE-79). An attacker with low privileges needs a user to interact with the page to exploit it, and the flaw affects confidentiality and integrity.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0036 29th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
joomshaper.com	Helix Ultimate extension for Joomla	1.0-2.2.10	—	No fix listed	CNA

Helix Ultimate extension for Joomla Vendorjoomshaper.com Affected 1.0-2.2.10 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Helix Ultimate extension for Joomla.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

2026-11-02 Threatist record created from CVE-2026-103419
2026-11-02 Alias added: GHSA-69vr-gf5m-pw3v
2026-11-02 CISA SSVC decision points changed
2026-11-02 Priority changed: MEDIUM → LOW

References

Other 1

https://www.joomshaper.com/joomla-templates/helixultimate

TI-2026-36168 Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2 KEVCVSS 4.0CRITICAL 10.0
TI-2026-46855 SQL injection in joomshaper.com Easy Store extension for Joomla CVSS 4.0CRITICAL 9.3
TI-2026-54317 SQL injection in joomshaper.com SP Property extension for Joomla CVSS 4.0CRITICAL 9.3
TI-2026-46920 Hard-coded credentials in joomshaper.com SP Page Builder extension for Joomla CVSS 3.1CRITICAL 9.8
TI-2026-54470 Cross-site scripting in joomshaper.com SP Property extension for Joomla CVSS 4.0HIGH 8.6
TI-2026-46917 SQL injection in joomshaper.com SP Page Builder extension for Joomla CVSS 4.0CRITICAL 9.2

See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences