CVE-2026-78077
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complete contextual escaping, allowing injection of malicious HTML/JS. Stricter sanitization and tag allowlists via `InputFilter` and `htmlspecialchars` were implemented.
| CWE | CWE-79 |
| Vendor | joomshaper.com |
| Product | helix ultimate extension for joomla |
| Published | Aug 31, 2026 |
| Last Updated | Aug 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for joomshaper.com helix ultimate extension for joomla
Be the first to know when new unknown vulnerabilities affecting joomshaper.com helix ultimate extension for joomla are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
joomshaper.com / Helix Ultimate extension for Joomla
1.0-2.2.9