What the vulnerability does
01Description
Joomla Solidres 2.13.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating multiple GET parameters including show, reviews, type_id, distance, facilities, categories, prices, location, and Itemid. Attackers can craft malicious URLs containing JavaScript payloads in these parameters to steal session tokens, login credentials, or manipulate site content when victims visit the crafted links.
Explanation of Vulnerability in Simple Terms
02Summary
Solidres for Joomla contains a cross-site scripting (XSS) vulnerability in version 2.13.3. An attacker can inject malicious scripts that execute in a victim's browser when they visit an affected page. The vulnerability requires user interaction to trigger. This can lead to session hijacking, credential theft, or malware distribution.
What an attacker can do
03Attacker Capabilities
Inject and execute malicious JavaScript in a victim's browser to steal session cookies or credentials.
Potential impact on your site
04Site Impact
Visitors' sessions and login credentials can be compromised; site reputation and user trust at risk.
Conditions required to exploit
05Prerequisites
Victim must click a malicious link or visit a crafted page; no authentication required.
Key dates
06Disclosure timeline
April 9, 2026
CVE published
May 24, 2026
Record updated
