CVE-2026-66494: SP Page Builder Stored XSS Vulnerability

CVE-2026-66494 Overview

CVE-2026-66494 is an unauthenticated stored cross-site scripting (XSS) vulnerability affecting the JoomShaper SP Page Builder extension for Joomla in versions prior to 6.7.0. The flaw resides in the Shapes API endpoint, where insufficient input sanitization allows an unauthenticated attacker to persist malicious JavaScript in the Joomla database using a single HTTP request. When a Joomla administrator subsequently opens the SP Page Builder editor, the injected payload executes in their browser session automatically. This condition maps to [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can hijack administrator sessions, escalate privileges, and take over Joomla sites running SP Page Builder prior to 6.7.0.

Affected Products

JoomShaper SP Page Builder for Joomla, versions prior to 6.7.0
Joomla sites exposing the Shapes API endpoint
Administrator accounts using the SP Page Builder editor

Discovery Timeline

2026-08-07 - CVE-2026-66494 published to NVD
2026-08-08 - Last updated in NVD database

Technical Details for CVE-2026-66494

Vulnerability Analysis

SP Page Builder exposes a Shapes API endpoint that accepts requests without authentication. The endpoint stores attacker-controlled content in the Joomla database without properly neutralizing HTML or JavaScript characters. Because the stored value is later rendered inside the administrator-facing SP Page Builder editor without contextual output encoding, arbitrary JavaScript executes in the administrator's browser context.

The stored nature of the payload distinguishes this issue from reflected XSS. A single unauthenticated HTTP request seeds the payload, and every administrator who later opens the editor triggers execution. Script running under an administrator session can create new admin accounts, install malicious Joomla extensions, exfiltrate content, or pivot to full site compromise.

Root Cause

The root cause is missing server-side input validation and missing output encoding in the Shapes API handler and editor rendering path. Untrusted request data flows into a persistent store and is later inserted into the editor DOM as executable script. See the JoomShaper Page Builder Overview for product context.

Attack Vector

The attack vector is network-based and requires no privileges. The attacker sends one crafted HTTP request to the vulnerable Shapes API endpoint. Exploitation completes when an administrator opens the SP Page Builder editor, satisfying the passive user-interaction requirement reflected in the CVSS vector.

No verified public proof-of-concept code is available at this time. Refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2026-66494

Indicators of Compromise

Unexpected POST or PUT requests to the SP Page Builder Shapes API endpoint from unauthenticated sources
Database rows in SP Page Builder tables containing <script>, onerror=, javascript:, or encoded script fragments
Creation of new Joomla Super User accounts shortly after an administrator opened the SP Page Builder editor
Installation of unfamiliar Joomla extensions or template overrides following editor access

Detection Strategies

Inspect web server access logs for anomalous requests to Shapes API URIs from unauthenticated clients
Run database queries against SP Page Builder content tables to identify stored HTML tags or script handlers
Correlate administrator editor access events with subsequent privileged actions in Joomla audit logs
Deploy web application firewall rules that flag script-like payloads targeting SP Page Builder endpoints

Monitoring Recommendations

Alert on new Joomla administrator account creation and extension installation events
Monitor outbound connections from administrator browsers to unknown domains during editor sessions
Track version inventory of SP Page Builder across all Joomla instances to identify unpatched sites

How to Mitigate CVE-2026-66494

Immediate Actions Required

Upgrade SP Page Builder to version 6.7.0 or later on all Joomla installations
Audit SP Page Builder database tables for stored script content and remove malicious entries
Review Joomla user accounts and installed extensions for unauthorized additions
Rotate administrator credentials and invalidate active administrative sessions

Patch Information

JoomShaper addresses the vulnerability in SP Page Builder 6.7.0. Administrators should apply the update through the Joomla Extensions Manager or download the current release from the vendor. Consult the JoomShaper Page Builder Overview for release information.

Workarounds

Restrict network access to the Joomla administrator interface using IP allowlists until patching is complete
Deploy a web application firewall rule that blocks unauthenticated requests to the Shapes API endpoint
Temporarily disable the SP Page Builder extension on sites that cannot be patched immediately

bash

# Example WAF rule concept blocking unauthenticated Shapes API writes
# Adapt to your WAF syntax (ModSecurity example)
SecRule REQUEST_URI "@contains /index.php?option=com_sppagebuilder" \
    "id:1026664940,phase:2,deny,status:403,\
    msg:'Block unauthenticated Shapes API write - CVE-2026-66494',\
    chain"
    SecRule REQUEST_METHOD "@rx ^(POST|PUT)$" "chain"
        SecRule &REQUEST_HEADERS:Cookie "@eq 0"