# cve.now: Joomshaper.com The newest entries naming Joomshaper.com as an affected vendor (up to 200), of 42 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-103419](https://cve.now/CVE-2026-103419.md): Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate \< 2.2.11. (CVSS 8.6) - [CVE-2026-105602](https://cve.now/CVE-2026-105602.md): Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate \< 2.2.11. (CVSS 8.6) - [CVE-2026-102426](https://cve.now/CVE-2026-102426.md): Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 (CVSS 5.3) - [CVE-2026-90903](https://cve.now/CVE-2026-90903.md): Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 (CVSS 7.2) - [CVE-2026-90901](https://cve.now/CVE-2026-90901.md): Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 (CVSS 8.6) - [CVE-2026-90905](https://cve.now/CVE-2026-90905.md): Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 (CVSS 7.2) - [CVE-2026-90902](https://cve.now/CVE-2026-90902.md): Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 (CVSS 8.6) - [CVE-2026-90904](https://cve.now/CVE-2026-90904.md): Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 (CVSS 8.6) - [CVE-2026-90899](https://cve.now/CVE-2026-90899.md): Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 (CVSS 8.2) - [CVE-2026-90900](https://cve.now/CVE-2026-90900.md): Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 (CVSS 5.3) - [CVE-2026-79701](https://cve.now/CVE-2026-79701.md): Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 (CVSS 6.9) - [CVE-2026-81566](https://cve.now/CVE-2026-81566.md): Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 (CVSS 5.1) - [CVE-2026-81565](https://cve.now/CVE-2026-81565.md): Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 (CVSS 6.9) - [CVE-2026-79700](https://cve.now/CVE-2026-79700.md): Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 (CVSS 6.9) - [CVE-2026-81564](https://cve.now/CVE-2026-81564.md): Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 (CVSS 7.0) - [CVE-2026-78375](https://cve.now/CVE-2026-78375.md): Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 (CVSS 8.6) - [CVE-2026-78085](https://cve.now/CVE-2026-78085.md): Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property \< 4.1.4 (CVSS 6.9) - [CVE-2026-78302](https://cve.now/CVE-2026-78302.md): Joomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property \< 4.1.4 (CVSS 8.6) - [CVE-2026-78083](https://cve.now/CVE-2026-78083.md): Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property \< 4.1.4 (CVSS 7.1) - [CVE-2026-78084](https://cve.now/CVE-2026-78084.md): Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property \< 4.1.4 (CVSS 6.9) - [CVE-2026-78082](https://cve.now/CVE-2026-78082.md): Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property \< 4.1.4 (CVSS 9.3) - [CVE-2026-78303](https://cve.now/CVE-2026-78303.md): Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property \< 4.1.4 (CVSS 6.9) - [CVE-2026-78075](https://cve.now/CVE-2026-78075.md): Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate \< 2.2.10 (CVSS 5.1) - [CVE-2026-78076](https://cve.now/CVE-2026-78076.md): Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate \< 2.2.10 (CVSS 5.1) - [CVE-2026-78078](https://cve.now/CVE-2026-78078.md): Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate \< 2.2.10 (CVSS 8.9) - [CVE-2026-78077](https://cve.now/CVE-2026-78077.md): Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate \< 2.2.11 (CVSS 8.6) - [CVE-2026-78079](https://cve.now/CVE-2026-78079.md): Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate \< 2.2.10 (CVSS 5.3) - [CVE-2026-67287](https://cve.now/CVE-2026-67287.md): Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder \< 6.8.0 (CVSS 6.3) - [CVE-2026-67286](https://cve.now/CVE-2026-67286.md): Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder \< 6.8.0 (CVSS 6.3) - [CVE-2026-67285](https://cve.now/CVE-2026-67285.md): Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder \< 6.8.0 (CVSS 9.2) - [CVE-2026-66494](https://cve.now/CVE-2026-66494.md): Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder \< 6.7.0 (CVSS 8.7) - [CVE-2026-65876](https://cve.now/CVE-2026-65876.md): Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder \< 6.8.0 (CVSS 9.2) - [CVE-2026-65877](https://cve.now/CVE-2026-65877.md): Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder \< 6.7.1 (CVSS 8.2) - [CVE-2026-65879](https://cve.now/CVE-2026-65879.md): Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder \< 6.7.1 (CVSS 9.8) - [CVE-2026-65766](https://cve.now/CVE-2026-65766.md): Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder \< 6.7.1 (CVSS 9.2) - [CVE-2026-65878](https://cve.now/CVE-2026-65878.md): Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder \< 6.7.1 (CVSS 8.3) - [CVE-2026-65759](https://cve.now/CVE-2026-65759.md): Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 (CVSS 8.7) - [CVE-2026-65761](https://cve.now/CVE-2026-65761.md): Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 (CVSS 9.3) - [CVE-2026-65760](https://cve.now/CVE-2026-65760.md): Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 (CVSS 9.2) - [CVE-2026-57830](https://cve.now/CVE-2026-57830.md): Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate \< 2.2.7 (CVSS 8.8) - [CVE-2026-57829](https://cve.now/CVE-2026-57829.md): Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate \< 2.2.7 (CVSS 8.7) - [CVE-2026-49049](https://cve.now/CVE-2026-49049.md): Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler (CVSS 7.5) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/joomshaper-com Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.