CVE-2026-60028

Deferred Deferred - Pending Action

Authenticated Stored XSS in Quix Page Builder Pro

Publication date: 2026-07-20

Last updated on: 2026-07-23

Assigner: Joomla! Project

Description

Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-23

Generated

2026-08-10

AI Q&A

2026-07-20

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60028

EUVD

EUVD-2026-46053

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	quix_page_builder_pro	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is an authenticated stored cross-site scripting (XSS) vulnerability in the Joomla extension Quix Page Builder Pro. An authenticated builder user can inject malicious scripts into SVG content or other unsanitized outputs. These scripts execute when any visitor or admin views the affected page.

Detection Guidance

Detection requires checking for the presence of the Quix Page Builder Pro extension in Joomla and reviewing pages for unsanitised SVG or script injections. Manually inspect Joomla admin panels for the extension and examine page source code for suspicious scripts or SVG tags. No specific commands are provided in the context.

Impact Analysis

An attacker with builder access could steal session cookies, perform actions on behalf of users, or deface the website. Visitors may have their data compromised or be redirected to malicious sites. Admin users viewing the page could have their accounts hijacked.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information, risking compliance with safeguard standards.

Mitigation Strategies

Immediately update Quix Page Builder Pro to the latest patched version. If an update is unavailable, disable the extension until a fix is released. Review all pages built with the extension for injected scripts or SVG content and remove any malicious code.

Hi! I’m here to help you understand CVE-2026-60028. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70