Live › vulnerability › CVE-2026-105602
The Helix Ultimate template extension for Joomla, from joomshaper.com, stores unsanitized badge text in its mega menu. An attacker who can write that text can run scripts in other users' browsers when the page loads.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Sites running the Helix Ultimate template for Joomla below version 2.2.11. The risk depends on who can edit mega menu items; the sources do not say whether anonymous users can reach it, so unknown.
No product ranges from the sources yet.
2.2.11.2.2.11 or later (from the source's version range: below 2.2.11 is affected).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.
This page as .md · .json · in your agent: get_signal("CVE-2026-105602")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.