CVE-2026-103419

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix…

Risk score: 52/100
CVSS: 8.6 v4.0
Published: 2 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.6 high

References

https://www.joomshaper.com/joomla-templates/helixultimate

Original description

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.

Last activity 2 Nov 2026. Patch Forecast updates every hour.