CVE-2026-60028
Received Received - Intake

Authenticated Stored XSS in Quix Page Builder Pro

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: Joomla! Project

Description
The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-60028
EUVD
EUVD-2026-46053

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomla quix_page_builder_pro *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authenticated stored cross-site scripting (XSS) vulnerability in the Joomla extension Quix Page Builder Pro. An authenticated builder user can inject malicious scripts into SVG content or other unsanitized outputs. These scripts execute when any visitor or admin views the affected page.

Detection Guidance

Detection requires checking for the presence of the Quix Page Builder Pro extension in Joomla and reviewing pages for unsanitised SVG or script injections. Manually inspect Joomla admin panels for the extension and examine page source code for suspicious scripts or SVG tags. No specific commands are provided in the context.

Impact Analysis

An attacker with builder access could steal session cookies, perform actions on behalf of users, or deface the website. Visitors may have their data compromised or be redirected to malicious sites. Admin users viewing the page could have their accounts hijacked.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information, risking compliance with safeguard standards.

Mitigation Strategies

Immediately update Quix Page Builder Pro to the latest patched version. If an update is unavailable, disable the extension until a fix is released. Review all pages built with the extension for injected scripts or SVG content and remove any malicious code.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-60028. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart