CVE-2026-66494Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://www.joomshaper.com/page-builder

Weakness type (CWE)

CWE-79CWE-284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-08-07); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-07	2	Disclosure1General1
2026-08-10	1	Disclosure1

Full discourse3 posts

CVE@CVEnew46d
General
CVE-2026-66494 Joomla Extension - http://joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaSc… https://www.cve.org/CVERecord?id=CVE-2026-66494
Post summary
The post announces a stored XSS vulnerability in the SP Page Builder extension for Joomla, providing its CVE ID and a brief technical description, but no PoC, exploit code, patch, or evidence of active exploitation.
010001.3K
57.9K followersView on X
CERT-PY@CERTpy43d
Disclosure
⚠️ Vulnerabilidades en productos Joomla ❗ CVE-2026-66914 ❗ CVE-2026-66494 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-joomla-3/ https://t.co/8uNNsLAdVv
Post summary
The tweet announces two Joomla CVEs and points to external links for additional information, serving as a vulnerability disclosure announcement.
00000219
6.7K followersView on X
Infoflowcloud@infoflowcloud46d
Disclosure
🚨*CVE* CVE-2026-66494 Joomla Extension - http://joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaSc… https://www.cve.org/CVERecord?id=CVE-2026-66494 ----- Traducción: CVE-2026-… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-66494, an unauthenticated stored XSS in the SP Page Builder extension before version 6.7.0, and links to the CVE record.
0000035
98 followersView on X

Explore more

Back to dashboard