CVE-2026-115452
Received Received - Intake

Privileged Stored XSS in Joomla tassos.gr Advanced Custom Fields and Smile Pack

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Joomla! Project

Description
Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-115452
EUVD
EUVD-2026-117625

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privileged stored Cross-Site Scripting (XSS) vulnerability in Joomla extensions Advanced Custom Fields and Smile Pack. A user with edit privileges, such as an article author, can inject malicious scripts into a Map marker label. When other users open the marker, the script executes in their browser.

Impact Analysis

An attacker could steal session cookies, redirect users to malicious sites, or perform actions on behalf of users. This could lead to unauthorized data access, account takeover, or spreading malware to other users who view the compromised marker.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data or HIPAA by exposing protected health information. It undermines data integrity and confidentiality requirements, potentially leading to regulatory penalties and loss of trust.

Mitigation Strategies

Update the tassos.gr Advanced Custom Fields extension to a version beyond 2.8.15 or 3.1.8 and Smile Pack to a version beyond 1.2.9 or 2.1.6 to address the privileged stored XSS vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...