CVE-2026-102426: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in joomshaper.com SP Page Builder (Pro) extension for Joomla

CVE-2026-102426 is a reflected XSS vulnerability in the Dynamic Content Filter addon of the SP Page Builder Pro extension for Joomla (versions 3.0.0 to 5.6.1p2). The issue occurs because the slider minimum and maximum values are extracted from the dc_filter_<fieldId> request parameter, split on a delimiter, HTML-escaped inside a data-value attribute, but then output without escaping as the span element's text content. This improper neutralization of input allows an unauthenticated attacker to reflect arbitrary HTML or JavaScript into the rendered page, potentially leading to script execution in the context of the victim's browser.

An unauthenticated attacker can exploit this vulnerability to inject arbitrary HTML or JavaScript into the web page viewed by other users. This can lead to typical reflected XSS impacts such as session hijacking, defacement, or redirection to malicious sites. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, but requiring user interaction and with limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider disabling or restricting use of the Dynamic Content Filter addon or implementing web application firewall (WAF) rules to detect and block malicious input patterns targeting the dc_filter_<fieldId> parameter.