CVE-2026-102426

Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2

View on CVE.org

Published Oct 5, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value.

Analysis

Technical impact

The flaw is a reflected XSS vulnerability (CWE‑79) in the Dynamic Content Filter addon of the SP Page Builder Pro extension for Joomla, affecting versions 3.0.0 through 5.6.1p2. The slider’s minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", then HTML‑escaped inside a data‑value attribute but echoed without escaping as a span element’s text content. This allows an attacker to inject arbitrary HTML or JavaScript that is rendered in the page when a crafted dc_filter_<fieldId> value is supplied.

Affected Systems

Joomla sites that have the SP Page Builder Pro extension from joomshaper.com installed in any version between 3.0.0 and 5.6.1p2 are impacted. Site administrators should verify the installed version of the extension to determine vulnerability exposure.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity reflected XSS. The EPSS score is not available, but because no authentication is required, any visitor to an affected page can exploit the flaw. The vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed widespread exploitation yet. If abused, the attacker could tamper with page content, steal session cookies, or conduct phishing attacks against users.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

joomshaper.com

SP Page Builder (Pro) extension for Joomla

unaffected

Version	Status	Constraints
`3.0.0 - 5.6.1p2`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:ollyo:sp_page_builder:::::pro:joomla\!::
	cpe:2.3:a:ollyo:sp_page_builder:5.6.1:-:::pro:joomla\!::

No data.

Vendor Product Versions

Joomshaper.net

Sp Page Builder Extension For Joomla

Version	Status	Scheme	Platform
`[3.0.0,5.6.1p2]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the SP Page Builder Pro extension to the latest version that patches the reflected XSS flaw
If the Dynamic Content Filter feature is not essential, disable it within the extension’s configuration to eliminate the attack surface
Deploy a web application firewall or enforce a strict content‑security‑policy to block reflected scripts from executing

Generated by OpenCVE AI on October 5, 2026 at 17:52 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.162% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro

History

Oct 14, 2026 7:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Ollyo Ollyo sp Page Builder
CPEs		cpe:2.3:a:ollyo:sp_page_builder:::::pro:joomla\!:: cpe:2.3:a:ollyo:sp_page_builder:5.6.1:-:::pro:joomla\!::
Vendors & Products		Ollyo Ollyo sp Page Builder
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Oct 6, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Joomshaper.net Joomshaper.net sp Page Builder Extension For Joomla
Vendors & Products		Joomshaper.net Joomshaper.net sp Page Builder Extension For Joomla

Oct 5, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 5, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value.
Title		Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2
Weaknesses		CWE-79
References		https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}`