CVE-2026-78077

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complete contextual escaping, allowing injection of malicious HTML/JS. Stricter sanitization and tag allowlists via `InputFilter` and `htmlspecialchars` were implemented.

Score
CVSS 4.0 8.6 High
Status
Deferred - security@joomla.org
Published
2026-08-31
Last modified
2026-09-01
Weaknesses
CWE-79

Affected products

References

 
 
© AVABIS GmbH privacypolicy about