CVE-2026-102426: Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3

Routine

MEDIUM 6.1UPGRADE

CVE-2026-102426 is a medium-severity flaw (CVSS 6.1) affecting sp page builder. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendere

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	6.1 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.2% (top 95%)
CISA exploited list	No
Weakness	CWE-79
Published	2026-10-05
Last modified	2026-10-14

Publisher (CNA): Joomla! Project · Vendor: ollyo

Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-10-05 16:17 UTCPublished CVE record published
2026-10-14 18:53 UTCUpdated Record last modified

ollyo sp page builder UPGRADE

Affected: >= 3.0.0 and < 5.6.1 · 5.6.1

Fixed in: 5.6.1

Safe to downgrade to: a release before 3.0.0

1. Check installed version

apt-cache policy sp-page-builder || rpm -q sp-page-builder || sp-page-builder --version

2. UPGRADE to 5.6.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade sp-page-builder

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade sp-page-builder

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 3.0.0 (Debian / Ubuntu)

apt-cache madison sp-page-builder sudo apt install sp-page-builder=<VERSION_BEFORE_3.0.0> sudo apt-mark hold sp-page-builder

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list sp-page-builder sudo dnf downgrade sp-page-builder-<VERSION_BEFORE_3.0.0> sudo dnf versionlock add sp-page-builder

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-102426?

sp page builder: upgrade to 5.6.1. Exact commands for each OS are on this page.

Is CVE-2026-102426 being exploited?

CVE-2026-102426 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-102426 affect?

CVE-2026-102426 affects sp page builder. Severity is medium (CVSS 6.1). Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the deli

How urgent is CVE-2026-102426?

Priority 23/100. No elevated risk signals yet.

Software pages

Joomla vulnerabilities

Related CVEs

CVE-2026-48908 CRITICAL 9.8 EXPLOITED UPGRADE JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

References

← Back to latest CVEs