{"id":"CVE-2026-105602","kind":"vulnerability","aliases":["CVE-2026-105602"],"related":[],"title":"Joomla Helix Ultimate: stored XSS in mega menu badge text","description":"Joomla Extension - joomshaper.com -  Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.","summary":"The Helix Ultimate template extension for Joomla, from joomshaper.com, stores unsanitized badge text in its mega menu. An attacker who can write that text can run scripts in other users' browsers when the page loads.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helix-ultimate","joomla","other","self-hosted"],"not_affected_if":["helix-ultimate-2.2.11-or-later"],"how_to_check":"- Check the installed Helix Ultimate version in the Joomla administrator under Extensions > Manage, compared with `2.2.11`.","fix":"- Helix Ultimate: move to `2.2.11` or later (from the source's version range: below `2.2.11` is affected).","status":"open","published_at":"2026-11-02T14:17:34+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","triaged_at":"2026-11-02T14:24:47+00:00","updated_at":"2026-11-02T14:24:47+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-02T14:24:47Z","model":"claude-haiku-5-5","output":{"fix":"- Helix Ultimate: move to `2.2.11` or later (from the source's version range: below `2.2.11` is affected).","reach":"network","title":"Joomla Helix Ultimate: stored XSS in mega menu badge text","impact":"medium","summary":"The Helix Ultimate template extension for Joomla, from joomshaper.com, stores unsanitized badge text in its mega menu. An attacker who can write that text can run scripts in other users' browsers when the page loads.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","helix-ultimate","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers and can steal admin sessions","analyst_note":"Confirm the required privilege to write badge text and whether the fix is in 2.2.11 via the NVD entry or the vendor advisory.","how_to_check":"- Check the installed Helix Ultimate version in the Joomla administrator under Extensions > Manage, compared with `2.2.11`.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["helix-ultimate-2.2.11-or-later"],"who_is_affected":"Sites running the Helix Ultimate template for Joomla below version 2.2.11. The risk depends on who can edit mega menu items; the sources do not say whether anonymous users can reach it, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4113,"output_tokens":544,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105602':13A,16A '-2026':12A,15A '2.2.11':77C 'attack':43B 'badg':9A,36B,72C 'browser':55B 'cross':65C 'cross-sit':64C 'cve':11A,14A 'extens':29B,61C 'helix':2A,18B,26B,75C 'helix-ultim':17B 'host':24B 'joomla':1A,20B,31B,60C 'joomshaper.com':33B,62C 'load':59B 'mega':7A,40B,70C 'menu':8A,41B,71C 'page':58B 'run':50B 'script':51B,67C 'self':23B 'self-host':22B 'site':66C 'store':4A,34B,63C 'templat':28B 'text':10A,37B,48B,73C 'ultim':3A,19B,27B,76C 'unsanit':35B 'user':54B 'write':46B 'xss':5A,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Helix Ultimate template for Joomla below version 2.2.11. The risk depends on who can edit mega menu items; the sources do not say whether anonymous users can reach it, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["helixultimate","high","joomla","other","selfhosted"],"first_public_at":"2026-11-02T14:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105602","severity":null,"published_at":"2026-11-02T14:17:34+00:00","modified_at":"2026-11-02T14:17:34+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","fetched_at":"2026-11-02T14:23:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}