CVE-2026-102426 Cross-site scripting in SP Page Builder (Pro) extension for Joomla
An unauthenticated attacker can execute arbitrary JavaScript in the victim's browser via a crafted request parameter in the SP Page Builder Pro extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-102426?
CVE-2026-102426 is a medium-severity cross-site scripting vulnerability in joomshaper.com SP Page Builder (Pro) extension for Joomla, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value.
Weakness: CWE-79
Which versions are affected by CVE-2026-102426?
It affects 1 product.
Products include Ollyo Sp Page Builder.
How do I fix CVE-2026-102426?
No fix has been published for CVE-2026-102426 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-102426 being exploited?
There is no known exploitation of CVE-2026-102426 in the wild and no public exploit code.
Other vulnerabilities in joomshaper.com SP Page Builder (Pro) extension for Joomla
Sources
Also known as GHSA-rwqh-f6r7-qgh8.