{"id":"CVE-2026-115452","kind":"vulnerability","aliases":["CVE-2026-115452"],"related":[],"title":"Joomla Advanced Custom Fields: stored script injection via map marker labels","description":"Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker.","summary":"A user allowed to edit a Map marker label in the Advanced Custom Fields extension for Joomla can store a script in it. The script then runs in the browser of anyone who opens that marker.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["advanced-custom-fields","joomla","runtime","self-hosted","smile-pack"],"not_affected_if":["extension-not-installed","fixed-version","no-map-fields"],"how_to_check":"- Check whether the Advanced Custom Fields (tassos.gr) extension is installed on your Joomla site and its version, in the Joomla administrator under Extensions > Manage.\n- Check whether the Smile Pack add-on is installed.\n- Look for Map fields with marker labels in articles and pages.","fix":"- Advanced Custom Fields: move to a version outside `2.8.2-2.8.15` and `3.0.0-3.1.8`; the sources do not name the fixed version.\n- Smile Pack: move to a version outside `1.1.2-1.2.9` and `2.0.0-2.1.6`; the sources do not name the fixed version.","status":"open","published_at":"2026-11-05T18:17:01+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","triaged_at":"2026-11-05T18:40:30+00:00","updated_at":"2026-11-05T18:40:30+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T18:40:30Z","model":"claude-haiku-5-5","output":{"fix":"- Advanced Custom Fields: move to a version outside `2.8.2-2.8.15` and `3.0.0-3.1.8`; the sources do not name the fixed version.\n- Smile Pack: move to a version outside `1.1.2-1.2.9` and `2.0.0-2.1.6`; the sources do not name the fixed version.","reach":"internet","title":"Joomla Advanced Custom Fields: stored script injection via map marker labels","impact":"medium","summary":"A user allowed to edit a Map marker label in the Advanced Custom Fields extension for Joomla can store a script in it. The script then runs in the browser of anyone who opens that marker.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["joomla","advanced-custom-fields","smile-pack","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in visitors' browsers, potentially stealing sessions for admins","analyst_note":"Confirm the fixed versions for Advanced Custom Fields and Smile Pack from the vendor advisory; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115452 does not give them.","how_to_check":"- Check whether the Advanced Custom Fields (tassos.gr) extension is installed on your Joomla site and its version, in the Joomla administrator under Extensions > Manage.\n- Check whether the Smile Pack add-on is installed.\n- Look for Map fields with marker labels in articles and pages.","plain_action":"","needs_analyst":true,"not_affected_if":["extension-not-installed","no-map-fields","fixed-version"],"who_is_affected":"Joomla sites running the affected Advanced Custom Fields or Smile Pack versions that use Map fields with marker labels. The attacker must be a user who can edit those labels, such as an article author, and the script runs for visitors who open the marker. Sites without the extension or without Map fields can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000795,"input_tokens":4284,"output_tokens":734,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115452':14A,17A '-2026':13A,16A '1.1.2':83C '1.2.9':84C '2.0.0':85C '2.1.6':86C '2.8.15':77C '2.8.2':76C '3.0.0':78C '3.1.8':79C 'add':101C 'advanc':2A,19B,41B,73C 'advanced-custom-field':18B 'allow':32B 'anyon':61B,107C 'articl':98C 'author':99C 'browser':59B 'could':90C,100C 'custom':3A,20B,42B,74C 'cve':12A,15A 'edit':34B,91C 'extens':44B,67C 'field':4A,21B,43B,75C 'host':26B 'inject':7A 'joomla':1A,22B,46B,66C 'label':11A,38B,95C 'like':96C 'map':9A,36B,93C 'marker':10A,37B,65B,94C,111C 'open':63B,109C 'pack':29B,82C 'privileg':69C 'ran':105C 'run':56B 'runtim':23B 'script':6A,50B,54B,103C 'self':25B 'self-host':24B 'smile':28B,81C 'smile-pack':27B 'store':5A,48B,70C 'tassos.gr':68C 'user':31B,88C 'via':8A 'xss':71C","nicknames":[],"mitigations":[],"who_affected":"Joomla sites running the affected Advanced Custom Fields or Smile Pack versions that use Map fields with marker labels. The attacker must be a user who can edit those labels, such as an article author, and the script runs for visitors who open the marker. Sites without the extension or without Map fields can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["advancedcustomfields","high","joomla","runtime","selfhosted","smilepack"],"campaign_type":null,"first_public_at":"2026-11-05T18:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115452","severity":null,"published_at":"2026-11-05T18:17:01+00:00","modified_at":"2026-11-05T18:17:01+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","fetched_at":"2026-11-05T18:40:09+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}