CVE-2026-102426: SP Page Builder Pro XSS Vulnerability

CVE-2026-102426 Overview

CVE-2026-102426 is a reflected Cross-Site Scripting (XSS) vulnerability in the Dynamic Content Filter addon of JoomShaper's SP Page Builder Pro extension for Joomla. The flaw affects versions 3.0.0 through 5.6.1p2. An unauthenticated attacker can inject arbitrary HTML or JavaScript into a rendered page by crafting a malicious dc_filter_<fieldId> request parameter. The addon echoes slider minimum and maximum values into a span element without proper output encoding, enabling script execution in the victim's browser context. The vulnerability is categorized under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser, enabling session theft, credential harvesting, and client-side account takeover against Joomla sites running vulnerable SP Page Builder Pro installations.

Affected Products

JoomShaper SP Page Builder Pro 3.0.0 through 5.6.1p2
Dynamic Content Filter addon within SP Page Builder Pro
Joomla sites deploying the affected extension

Discovery Timeline

2026-10-05 - CVE-2026-102426 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-102426

Vulnerability Analysis

The Dynamic Content Filter addon processes slider range values from the dc_filter_<fieldId> HTTP request parameter. The server splits the parameter value on the delimiter l-r to extract minimum and maximum slider bounds. These extracted values are then written to two separate output locations within the rendered page.

The first write places the values inside a data-value HTML attribute, where they are HTML-escaped. The second write echoes the same values as the text content of a span element without any escaping. This inconsistent handling creates the reflected XSS condition. Because exploitation requires only an unauthenticated HTTP request and user interaction with a crafted URL, the attack surface spans any public page where the Dynamic Content Filter addon is rendered.

Root Cause

The root cause is missing output encoding on untrusted input flowing into an HTML text node. The developer applied HTML entity escaping for the attribute sink but omitted the same encoding when writing the value as element text, violating the principle of consistent contextual output encoding (CWE-79).

Attack Vector

An attacker crafts a URL containing a malicious dc_filter_<fieldId> parameter where the payload is delivered after the l-r delimiter. When a victim visits the URL, the vulnerable span element renders the attacker-controlled markup, executing JavaScript in the victim's origin. No authentication is required, and the attack succeeds against any visitor who loads the page.

See the vendor product page for the affected extension at JoomShaper SP Page Builder Pro.

Detection Methods for CVE-2026-102426

Indicators of Compromise

HTTP requests containing the parameter pattern dc_filter_* with values that include <, >, script, onerror, onload, or event handler strings.
Access log entries where the dc_filter_<fieldId> value contains the l-r delimiter followed by HTML tags or JavaScript syntax.
Referrer headers pointing to attacker-controlled domains that redirect users to internal Joomla pages carrying crafted filter parameters.

Detection Strategies

Deploy web application firewall rules that inspect query string and POST body parameters matching the dc_filter_ prefix for HTML or script metacharacters.
Correlate browser-side Content Security Policy (CSP) violation reports with server access logs to identify reflected payload delivery.
Hunt in web server logs for requests to pages rendering the Dynamic Content Filter addon that contain unusual encoded characters such as %3C, %3E, or %22 within dc_filter_ values.

Monitoring Recommendations

Monitor outbound requests from user browsers to unexpected domains following interaction with Joomla site URLs.
Alert on administrator session tokens being used from new IP addresses or user agents shortly after suspicious dc_filter_ requests.
Track volume anomalies in requests to SP Page Builder Pro pages, particularly spikes in parameters matching the vulnerable pattern.

How to Mitigate CVE-2026-102426

Immediate Actions Required

Upgrade SP Page Builder Pro to a version later than 5.6.1p2 that includes the vendor fix for the Dynamic Content Filter addon.
Audit all Joomla sites using JoomShaper extensions to inventory installed versions and prioritize patching of public-facing pages.
Review web server access logs for the past 90 days for requests containing dc_filter_<fieldId> parameters with suspicious payloads and investigate associated sessions.

Patch Information

Refer to the vendor product page at JoomShaper SP Page Builder Pro for the latest release and security notes. Apply the fixed version through the Joomla Extension Manager and confirm the Dynamic Content Filter addon version post-upgrade.

Workarounds

Disable the Dynamic Content Filter addon within SP Page Builder Pro until the patched version is deployed.
Deploy a web application firewall rule to block or sanitize requests where dc_filter_* parameters contain HTML metacharacters.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, reducing exploit impact.

bash

# Example ModSecurity rule to block HTML/script metacharacters in dc_filter_* parameters
SecRule ARGS_NAMES "@rx ^dc_filter_" \
    "chain,id:1026102426,phase:2,deny,status:403,\
    msg:'CVE-2026-102426 - Reflected XSS attempt in SP Page Builder Pro Dynamic Content Filter'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:|<img|<svg)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"