CVE-2026-60028 is an authenticated stored XSS vulnerability in themexpert.com's Quix Page Builder Pro Joomla extension affecting versions 1.0 to 6.2.0. An authenticated user with builder privileges can inject malicious scripts due to improper neutralization of input during web page generation, specifically from unescaped output and unsanitized SVG elements. These scripts execute in the context of any visitor or admin viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The CVSS 4.0 base score is 8.6, indicating a high severity vulnerability with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability allows authenticated builder users to inject persistent malicious scripts that execute in the browsers of visitors and administrators viewing the affected pages. This can lead to unauthorized actions such as session hijacking, defacement, or other malicious activities executed with the privileges of the victim's browser session. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the Joomla site.

No official patch or remediation has been confirmed or published by the vendor as of the information provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict builder user privileges to trusted individuals only and consider disabling or limiting use of the Quix Page Builder Pro extension. Monitor vendor channels for updates and apply patches promptly once released.