CVE-2026-60029: Quix Page Builder XSS Vulnerability

CVE-2026-60029 Overview

CVE-2026-60029 is an authenticated stored cross-site scripting (XSS) vulnerability affecting the Quix Page Builder Pro extension for Joomla, developed by ThemeXpert. Versions prior to 6.2.1 are affected. Authenticated builder users can inject malicious payloads into id and class attribute fields that render on public-facing pages. When visitors load an affected page, the injected script executes in their browsers under the site's origin. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Authenticated users with builder privileges can plant persistent JavaScript payloads that execute in any visitor's browser, enabling session theft, credential harvesting, and site defacement.

Affected Products

• ThemeXpert Quix Page Builder Pro for Joomla, versions prior to 6.2.1
• Joomla sites using the Quix Page Builder extension for public content rendering
• Any downstream site consuming Quix-authored pages

Discovery Timeline

• 2026-07-20 - CVE-2026-60029 published to NVD
• 2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60029

Vulnerability Analysis

Quix Page Builder Pro allows authenticated builder users to configure HTML id and class attributes on page components through its editor interface. The extension fails to properly neutralize input before writing these attribute values into the rendered HTML delivered to public visitors. An attacker with builder-level access can break out of the attribute context by injecting quote characters, closing tags, or event handlers such as onmouseover and onerror. Once the crafted page is published, the payload runs in the browser of every unauthenticated visitor. Because privileges are required, the attack surface is limited to sites with multiple content editors or sites where lower-privilege accounts can be compromised. The impact is amplified by the persistent nature of stored XSS, as the payload survives across sessions until removed.

Root Cause

The root cause is missing output encoding when Quix renders user-controlled attribute values into HTML. The id and class fields are intended to accept short identifiers, but the extension neither validates them against a strict character allowlist nor applies contextual HTML attribute escaping before rendering. This maps directly to [CWE-79], where untrusted input reaches an HTML sink without proper sanitization.

Attack Vector

Exploitation requires an authenticated Joomla account with permission to edit Quix pages. The attacker opens the Quix editor, selects a component, and enters a crafted string into the id or class field. The payload closes the attribute, injects an event handler, and executes JavaScript when the affected element renders or is interacted with. No user interaction is required beyond visiting the compromised page. The vulnerability is exploitable over the network against the Joomla front end. See the ThemeXpert Quix Pagebuilder Overview for product details.

Detection Methods for CVE-2026-60029

Indicators of Compromise

• Quix component id or class attribute values containing quote characters, angle brackets, or event handler names such as onerror, onload, or onmouseover.
• Unexpected <script> tags or inline JavaScript in rendered pages authored through Quix Page Builder.
• Outbound requests from visitor browsers to unfamiliar domains immediately after loading Quix-authored pages.

Detection Strategies

• Audit the Joomla database tables that store Quix component configuration for attribute values that do not match a strict [A-Za-z0-9_-] pattern.
• Compare rendered HTML output against expected component templates and flag deviations in attribute structure.
• Review Joomla administrator access logs for builder-role logins from unexpected IP addresses or at unusual times.

Monitoring Recommendations

• Enable Content Security Policy (CSP) reporting to capture script-source violations on pages that host Quix content.
• Monitor web server access logs for anomalous requests targeting Quix-rendered pages, particularly requests with suspicious Referer values.
• Track changes to Quix page configurations through Joomla's audit logging or a third-party file integrity monitor.

How to Mitigate CVE-2026-60029

Immediate Actions Required

• Upgrade Quix Page Builder Pro to version 6.2.1 or later on all Joomla sites.
• Review all existing Quix components for injected content in id and class fields and remove any suspicious values.
• Rotate credentials for Joomla accounts with builder-level access and enforce multi-factor authentication.

Patch Information

ThemeXpert has addressed the flaw in Quix Page Builder Pro version 6.2.1. Administrators should apply the update through the Joomla Extension Manager or download the latest release from the vendor. Refer to the ThemeXpert Quix Pagebuilder Overview for release information.

Workarounds

• Restrict builder-role assignments to trusted administrators until the patch is applied.
• Deploy a web application firewall (WAF) rule that blocks HTML metacharacters in requests targeting Quix editor endpoints.
• Apply a strict Content Security Policy that disallows inline scripts and unknown script sources on public pages.

# Example Content-Security-Policy header for Joomla front end
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report"