CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG.
Explanation of Vulnerability in Simple Terms
Quix Page Builder Pro for Joomla contains a cross-site scripting (XSS) vulnerability in versions 1.0-6.2.0. An authenticated administrator with high privileges can inject malicious scripts that execute in the browser of other users viewing the site. The vulnerability requires administrator access to exploit and does not directly compromise the server, but can be used to deface content or steal user sessions.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they view the site.
Potential impact on your site
An admin account compromise allows an attacker to inject scripts affecting all site visitors, potentially stealing sessions or defacing content.
Conditions required to exploit
Attacker must have administrator-level access to the Joomla site.
Key dates
External resources
Related vulnerabilities
