CVE-2026-66494: Joomshaper.com SP Page Builder Extension For Joomla

High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days.

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..

Affected products

• Joomshaper.com SP Page Builder Extension For Joomla: version 1.0.0-6.6.2 only

Published 2026-08-07. Last modified 2026-08-26.