CVE-2026-78302: Joomla SP Property XSS Vulnerability

CVE-2026-78302 Overview

CVE-2026-78302 is an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the JoomShaper SP Property extension for Joomla, affecting versions prior to 4.1.4. Multiple template files across frontend views and administrator list tables render attributes and text values directly into HTML without contextual escaping. Attackers can inject persistent JavaScript payloads that execute when victims view affected pages. The flaw is tracked under CWE-79 and does not require authentication to exploit.

Critical Impact
Unauthenticated attackers can store malicious JavaScript that executes in the context of administrators viewing backend list tables, enabling session theft, account takeover, and further compromise of the Joomla site.

Affected Products

JoomShaper SP Property extension for Joomla
SP Property versions prior to 4.1.4
Joomla sites using vulnerable frontend views and administrator list tables from SP Property

Discovery Timeline

2026-09-10 - CVE-2026-78302 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78302

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in the SP Property real estate extension distributed by JoomShaper. Multiple template files across the extension write user-controlled property attributes and text values straight into rendered HTML output. The templates omit contextual escaping functions expected in Joomla view rendering, such as htmlspecialchars or the framework's $this->escape() helper.

Because the affected code paths are reachable by unauthenticated visitors submitting or interacting with property data, attackers can plant persistent payloads without any prior account access. Payloads are then re-served on both the public site and the administrator backend, expanding the blast radius to privileged users.

Root Cause

The root cause is missing output encoding in view layer templates. Attribute values and text content sourced from the property data model are concatenated into HTML markup without being passed through Joomla's escaping API. This violates the principle of contextual output encoding for HTML attribute and text contexts, allowing raw <script> tags or event handler injections such as onerror and onclick to render as executable markup.

Attack Vector

The attack vector is network-based with no privileges required, though user interaction is needed to trigger the stored payload when an administrator or visitor loads the affected view. An attacker submits crafted content into fields consumed by the vulnerable templates. When a user loads a frontend view or an administrator opens the SP Property list table in the backend, the injected script executes in the browser under the site's origin. This enables session cookie theft, Cross-Site Request Forgery (CSRF) against administrative endpoints, and arbitrary DOM manipulation.

No verified public exploit code is available. See the JoomShaper SP Property Extension page for vendor details.

Detection Methods for CVE-2026-78302

Indicators of Compromise

HTML markup, <script> tags, or JavaScript event handlers (onerror, onload, onclick) stored in SP Property database records or rendered in list tables.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after opening SP Property admin pages.
Creation of new Joomla Super User accounts or unexplained changes to user privileges following administrator sessions.

Detection Strategies

Audit SP Property database tables for suspicious characters and HTML tags in property attribute and text fields.
Inspect web server access logs for POST requests to SP Property submission endpoints containing URL-encoded <script>, %3Cscript, or javascript: payloads.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution violations on pages rendered by SP Property.

Monitoring Recommendations

Monitor administrator sessions for anomalous API calls originating from browsers viewing the SP Property admin list.
Alert on modifications to Joomla #__users and #__user_usergroup_map tables outside of change windows.
Track file integrity of Joomla administrator/ directories and extension template files for unexpected changes.

How to Mitigate CVE-2026-78302

Immediate Actions Required

Upgrade the JoomShaper SP Property extension to version 4.1.4 or later on all Joomla installations.
Purge cached pages and rendered views to remove any stored malicious markup from delivery layers.
Review SP Property submissions and administrator activity for signs of exploitation, and rotate administrator credentials and session tokens if compromise is suspected.

Patch Information

JoomShaper has addressed the vulnerability in SP Property version 4.1.4. Refer to the JoomShaper SP Property Extension page for the current release. Administrators should apply the update through the Joomla Extensions Manager and verify the installed version after upgrade.

Workarounds

Restrict access to SP Property submission endpoints via a Web Application Firewall (WAF) rule blocking requests containing HTML tags or JavaScript event handlers until the patch is applied.
Enforce a strict Content Security Policy that disallows inline scripts on pages rendered by the extension to limit payload execution.
Temporarily disable the SP Property extension in Joomla's Extension Manager if immediate patching is not feasible.

bash

# Example WAF rule (ModSecurity) blocking script payloads to SP Property endpoints
SecRule REQUEST_URI "@contains index.php?option=com_spproperty" \
    "chain,id:1002026,phase:2,deny,status:403,log,msg:'CVE-2026-78302 SP Property XSS attempt'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni,t:htmlEntityDecode"