CVE-2026-102426 MEDIUM 5.3
Published: 2026-10-05 16:17:04 UTC · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Categories: Web servers & CMS
Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value.
Weakness: CWE-79
Affected products
cpe:2.3:a:ollyo:sp_page_builder:*:*:*:*:pro:joomla\!:*:*cpe:2.3:a:ollyo:sp_page_builder:5.6.1:-:*:*:pro:joomla\!:*:*