CVE-2026-57829 HIGH

CVE-2026-57829: Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7

Vendor Joomshaper.com
Product Helix Ultimate extension for Joomla
Weakness CWE-79 · XSS
Published July 13, 2026
Last update July 13, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The Joomla extension Helix Ultimate is vulnerable to an unauthenticated stored XSS.

Explanation of Vulnerability in Simple Terms

02Summary

Helix Ultimate extension for Joomla contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. An attacker can craft a malicious link or page that, when visited by a site administrator or user, executes arbitrary JavaScript in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript code in users' browsers when they visit a crafted page or link.

Potential impact on your site

04Site Impact

Administrators and users visiting affected pages risk session hijacking, credential theft, and unauthorized site modifications.

Conditions required to exploit

05Prerequisites

The victim must visit a page or click a link containing the malicious payload. No authentication required.

Key dates

06Disclosure timeline

July 13, 2026 CVE published
July 13, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57360 WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-57354 WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-57349 WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerability CVE-2026-57764 WordPress Surbma | Yoast SEO Breadcrumb Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-27402 WordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerability