CVE-2026-60028 Overview
CVE-2026-60028 is an authenticated stored cross-site scripting (XSS) vulnerability in the Quix Page Builder Pro extension for Joomla, developed by ThemeXpert. The flaw affects Quix Page Builder versions prior to 6.2.1. An authenticated user with builder privileges can inject arbitrary JavaScript that executes in the browsers of any visitor or administrator viewing the affected page. The root cause is unescaped output combined with unsanitized Scalable Vector Graphics (SVG) content. The stored payload persists across sessions, enabling session hijacking, credential theft, and administrative account takeover.
Critical Impact
Injected scripts execute in the context of every visitor and administrator, exposing session tokens and enabling account takeover through a persistent payload stored in Quix-built pages.
Affected Products
- ThemeXpert Quix Page Builder Pro for Joomla versions prior to 6.2.1
- Joomla sites using vulnerable Quix builder pages served to unauthenticated visitors
- Administrator sessions viewing pages containing crafted SVG or unescaped content
Discovery Timeline
- 2026-07-20 - CVE-2026-60028 published to the National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in the NVD database
Technical Details for CVE-2026-60028
Vulnerability Analysis
CVE-2026-60028 is a stored cross-site scripting flaw classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. The vulnerability requires an authenticated user with page-building privileges to inject the payload. Once stored, the payload executes for every subsequent viewer of the compromised page, including unauthenticated visitors and Joomla administrators.
Because the payload runs in a privileged administrator's browser session, attackers can perform any action the administrator is authorized to perform. This includes creating new administrative accounts, modifying extension settings, or planting server-side backdoors through legitimate Joomla features.
Root Cause
Two distinct sanitization failures combine to produce the vulnerability. First, Quix Page Builder writes user-controlled content into rendered HTML without applying context-appropriate output encoding. Second, uploaded or embedded SVG documents are not sanitized to strip active content such as <script> blocks, on* event handlers, and javascript: URIs. The combination allows both direct HTML script injection and SVG-borne script execution.
Attack Vector
An attacker with a builder-level Joomla account authenticates to the administrative back end and edits or creates a Quix page. The attacker injects a malicious payload through a text widget, HTML block, or an SVG upload. When any visitor loads the page, the browser parses the injected markup and executes the attacker's JavaScript in the origin of the target Joomla site. Delivery does not require user interaction beyond visiting the page, and attack complexity over the network is low. The primary barrier is obtaining an authenticated builder account, which raises the required privilege level.
Exploitation code is not published in verified sources. Refer to the ThemExpert Quix Pagebuilder Overview for product context and update guidance.
Detection Methods for CVE-2026-60028
Indicators of Compromise
- Quix-built pages containing inline <script> tags, on* event handler attributes, or javascript: URIs that were not authored by trusted staff
- SVG assets uploaded through Quix that contain <script>, <foreignObject>, or event handler attributes
- New Joomla Super User accounts created shortly after a page edit by a non-administrative builder user
- Outbound requests from visitor browsers to unfamiliar domains sourced from Quix page URLs
Detection Strategies
- Audit the Quix content database tables for stored HTML containing script tags, event handlers, or encoded JavaScript payloads
- Scan the Joomla media library for SVG files and inspect their contents for active elements using an XML parser
- Review Joomla action logs for page edits performed by builder-role accounts and correlate with subsequent administrative changes
- Deploy a Content Security Policy (CSP) in report-only mode to surface script sources that violate an allowlist
Monitoring Recommendations
- Alert on creation or elevation of Joomla administrator accounts, especially when preceded by builder activity
- Monitor web server logs for unusual query patterns against Quix page URLs that may indicate payload probing
- Track file uploads with the .svg extension and route them through automated content inspection before publication
How to Mitigate CVE-2026-60028
Immediate Actions Required
- Upgrade Quix Page Builder Pro to version 6.2.1 or later on all Joomla instances
- Audit all builder-role accounts and revoke access for users who do not require page-editing privileges
- Inspect existing Quix pages and SVG uploads for injected scripts and remove any unauthorized content
- Rotate Joomla administrator session tokens and passwords if compromise is suspected
Patch Information
ThemeXpert addresses CVE-2026-60028 in Quix Page Builder Pro version 6.2.1. The fix applies output escaping to user-supplied content and sanitizes SVG uploads to strip active elements and event handlers. Administrators should verify the installed version through the Joomla extension manager after applying the update.
Workarounds
- Restrict the builder role to trusted users only, treating it as equivalent to administrative access until patched
- Disable SVG uploads through Joomla media manager configuration to block the SVG-based attack path
- Deploy a strict Content Security Policy that forbids inline scripts and restricts script sources to a known allowlist
- Place a web application firewall (WAF) rule in front of Joomla to block requests containing script tags or event handler attributes in Quix editor endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
