CVE-2026-60028

HighCVSS 8.6/10Last modified Oct 24, 2026

Description

Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG.

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
themexpert.com	Quix Page Builder Pro extension for Joomla	1.0-6.2.0

References

https://www.themexpert.com/quix-pagebuilder

Timeline

Published: Jul 20, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-600295.1Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vu CVE-2026-60032.4A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This issue affects some unknown processing of th CVE-2026-600308.7Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page CVE-2026-600316.9Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vuln CVE-2026-600329.4Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an CVE-2026-600335.1Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to an S CVE-2026-600349.4Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a st CVE-2026-600357.2A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can res CVE-2026-600367.2A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can r CVE-2026-600377.2A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution.CVE-2026-600387.2A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. Thi CVE-2026-600397.2A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can r