CVE-2026-60028

Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1

State: Published
Severity: 8.6 High
Published: Jul 20, 2026
Updated: Jul 23, 2026
Reserved: Jul 8, 2026

Description

Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	Joomla

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Quix Page Builder Pro extension for Joomlathemexpert.com	1.0-6.2.0Affected

References

https://www.themexpert.com/quix-pagebuilderproduct

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.