{"id":"CVE-2026-103419","kind":"vulnerability","aliases":["CVE-2026-103419"],"related":[],"title":"Joomla Helix Ultimate template: stored XSS in Media Picker before 2.2.11","description":"Joomla Extension - joomshaper.com -  Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.","summary":"The Helix Ultimate extension for Joomla, made by joomshaper.com, has a stored cross-site scripting flaw in its Media Picker. An attacker who can put content into the site can run scripts in other users' browsers.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helix-ultimate","joomla","other","web-cms"],"not_affected_if":["not-joomla","version-2.2.11-or-later"],"how_to_check":"- Check the installed Helix Ultimate version in the Joomla administrator under installed extensions\n- Flag any version below `2.2.11` as affected","fix":"- Helix Ultimate: move to `2.2.11` or later","status":"open","published_at":"2026-11-02T14:17:34+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","triaged_at":"2026-11-02T14:24:47+00:00","updated_at":"2026-11-02T14:24:47+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-02T14:24:47Z","model":"claude-haiku-5-5","output":{"fix":"- Helix Ultimate: move to `2.2.11` or later","reach":"internet","title":"Joomla Helix Ultimate template: stored XSS in Media Picker before 2.2.11","impact":"medium","summary":"The Helix Ultimate extension for Joomla, made by joomshaper.com, has a stored cross-site scripting flaw in its Media Picker. An attacker who can put content into the site can run scripts in other users' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","helix-ultimate","web-cms"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker script runs in visitor and admin browsers, stealing sessions","analyst_note":"","how_to_check":"- Check the installed Helix Ultimate version in the Joomla administrator under installed extensions\n- Flag any version below `2.2.11` as affected\n- unknown for other checks","plain_action":"","needs_analyst":false,"not_affected_if":["not-joomla","version-2.2.11-or-later"],"who_is_affected":"Sites running the Helix Ultimate template for Joomla below version 2.2.11 are exposed. The sources do not say which roles can write the content that triggers the flaw, so unknown for who can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":4101,"output_tokens":494,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103419':14A,17A '-2026':13A,16A '2.2.11':11A,78C 'attack':48B 'browser':62B 'cms':25B 'content':52B 'cross':39B,68C 'cross-sit':38B,67C 'cve':12A,15A 'extens':29B,64C 'flaw':42B 'helix':2A,19B,27B,76C 'helix-ultim':18B 'joomla':1A,21B,31B,63C 'joomshaper.com':34B,65C 'made':32B 'media':8A,45B,73C 'picker':9A,46B,74C 'put':51B 'run':57B 'script':41B,58B,70C 'site':40B,55B,69C 'store':5A,37B,66C 'templat':4A 'ultim':3A,20B,28B,77C 'user':61B 'web':24B 'web-cm':23B 'xss':6A,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Helix Ultimate template for Joomla below version 2.2.11 are exposed. The sources do not say which roles can write the content that triggers the flaw, so unknown for who can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["helixultimate","high","joomla","other","webcms"],"first_public_at":"2026-11-02T14:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103419","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103419","severity":null,"published_at":"2026-11-02T14:17:34+00:00","modified_at":"2026-11-02T14:17:34+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","fetched_at":"2026-11-02T14:23:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}