CVE-2025-49486: Balbooa.com Balbooa Gallery Component For Joomla

High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days.

A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items.

Affected products

• Balbooa.com Balbooa Gallery Component For Joomla: version 1.0.0-2.4.0 only

Published 2025-07-18. Last modified 2026-06-17.