---
id: "CVE-2026-105602"
kind: "vulnerability"
aliases: ["CVE-2026-105602"]
title: "Joomla Helix Ultimate: stored XSS in mega menu badge text"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["helix-ultimate", "joomla", "other", "self-hosted"]
not_affected_if: ["helix-ultimate-2.2.11-or-later"]
published_at: "2026-11-02T14:17:34+00:00"
first_seen_at: "2026-11-02T14:23:23+00:00"
updated_at: "2026-11-02T14:24:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105602", "first_seen_at": "2026-11-02T14:23:23+00:00"}]
---

# Joomla Helix Ultimate: stored XSS in mega menu badge text

The Helix Ultimate template extension for Joomla, from joomshaper.com, stores unsanitized badge text in its mega menu. An attacker who can write that text can run scripts in other users' browsers when the page loads.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Helix Ultimate version in the Joomla administrator under Extensions > Manage, compared with `2.2.11`.

## Fix

- Helix Ultimate: move to `2.2.11` or later (from the source's version range: below `2.2.11` is affected).

## Timeline

- 2026-11-02T14:23:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105602

## From the sources

Joomla Extension - joomshaper.com -  Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_