The Helix Ultimate extension for Joomla contains a stored cross‑site scripting vulnerability in the Mega Menu Badge Text field. An attacker who can inject content into this field can place malicious JavaScript that executes in the browsers of any user who views the affected page. This can lead to session hijacking, defacement, or retrieval of sensitive data such as authentication cookies.

The vulnerability affects the joomshaper.com Helix Ultimate extension for Joomla versions earlier than 2.2.11. Any site using Helix Ultimate 2.2.10 or older is potentially vulnerable.

The CVSS score of 8.6 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is via the Mega Menu Badge Text input, which may be accessible to users with menu‑editing rights. An attacker who can influence that input could exploit the stored XSS to run arbitrary scripts in the context of the site’s visitors.