CVE-2026-75955: J-BusinessDirectory XSS Vulnerability

CVE-2026-75955 Overview

CVE-2026-75955 is a reflected cross-site scripting (XSS) vulnerability in the J-BusinessDirectory Joomla extension developed by cmsjunkie.com. The flaw affects versions prior to 6.2.3. The extension writes the companyName parameter from user requests directly into an XML attribute without escaping. Attackers can inject malicious content that breaks out of the XML attribute context and executes in the victim's browser. The issue is classified as [CWE-79] and combines reflected XSS with XML injection characteristics.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser context of any user who follows a crafted link, enabling session theft, credential harvesting, and directory content manipulation.

Affected Products

J-BusinessDirectory Joomla extension versions prior to 6.2.3
Joomla sites running vulnerable J-BusinessDirectory instances
cmsjunkie.com commercial extension deployments

Discovery Timeline

2026-08-19 - CVE-2026-75955 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75955

Vulnerability Analysis

The vulnerability exists in the J-BusinessDirectory extension's handling of the companyName request parameter. The application reads the parameter value from the HTTP request and writes it directly into an XML attribute without applying context-appropriate escaping. Because XML attribute values require encoding of characters such as quotes, ampersands, and angle brackets, the missing escaping allows attackers to close the attribute and inject arbitrary markup.

When the resulting XML response is rendered or parsed in a browser context, injected script content executes with the origin of the vulnerable Joomla site. The reflected nature of the flaw means the payload is delivered through a crafted URL or form submission and returned in the immediate response. No authentication is required to trigger the issue, but user interaction is required to visit the malicious link.

Root Cause

The root cause is improper neutralization of input during web page generation, tracked as [CWE-79]. The companyName value is concatenated into XML output without an XML attribute encoder. Developers assumed the XML context would be safe, but browsers and downstream parsers interpret the reflected content as active markup.

Attack Vector

Attackers craft a URL containing a malicious companyName value with XML attribute-breaking characters. The victim clicks the link, and the server reflects the payload into the XML response. The injected script executes in the victim's browser, allowing session cookie theft, actions performed as the victim, or redirection to attacker-controlled infrastructure. The attack requires user interaction but no privileges. See the CMS Junkie Blog for vendor communications.

Detection Methods for CVE-2026-75955

Indicators of Compromise

Web server logs containing companyName parameter values with quote characters, angle brackets, or javascript: scheme references
Unusual outbound requests from user browsers to unknown domains following visits to J-BusinessDirectory pages
XML responses from J-BusinessDirectory endpoints containing unescaped attribute delimiters

Detection Strategies

Deploy a web application firewall rule that flags companyName values containing ", <, >, or & characters when submitted to J-BusinessDirectory endpoints
Inspect HTTP request logs for reflected XSS payload signatures such as onerror=, onload=, or <script sequences targeting the extension
Correlate anomalous JavaScript execution telemetry from endpoint agents with visits to Joomla directory URLs

Monitoring Recommendations

Enable verbose access logging on the Joomla web server and retain logs for at least 90 days
Monitor J-BusinessDirectory administrator accounts for unexpected session activity or configuration changes
Alert on referrer patterns showing external sites redirecting users into companyName parameter URLs

How to Mitigate CVE-2026-75955

Immediate Actions Required

Upgrade J-BusinessDirectory to version 6.2.3 or later on all Joomla installations
Audit administrator and editor accounts for signs of session hijacking or unauthorized changes
Rotate Joomla session secrets and force re-authentication for privileged users

Patch Information

The vendor addressed the issue in J-BusinessDirectory version 6.2.3. Site administrators should download the current release from the CMS Junkie Blog and apply it through the Joomla extension manager. Verify the installed version in the Joomla administrator panel after upgrade.

Workarounds

Configure a reverse proxy or WAF to reject requests where companyName contains characters that break XML attribute context
Restrict access to J-BusinessDirectory endpoints to authenticated users where feasible until patching is complete
Implement a Content Security Policy that disables inline scripts to reduce the impact of reflected XSS

bash

# Example ModSecurity rule to block XML-breaking payloads in companyName
SecRule ARGS:companyName "@rx [\"<>&]" \
    "id:1075955,phase:2,deny,status:403,\
    msg:'CVE-2026-75955 J-BusinessDirectory XSS attempt blocked'"