CVE-2026-60028 is an authenticated stored XSS vulnerability in the themexpert.com Quix Page Builder Pro extension for Joomla. The flaw allows authenticated builder users to inject malicious scripts due to improper neutralization of input during web page generation, specifically through unescaped output and unsanitized SVG content. When a visitor or admin views the compromised page, the injected script executes, potentially leading to session hijacking or other script-based attacks. The vulnerability affects versions =1.0-6.2.0 of the extension. No official patch or remediation level has been published yet.

An authenticated user with builder privileges can inject malicious scripts that execute in the context of other users viewing the page, including administrators. This can lead to unauthorized actions, session hijacking, or other impacts typical of stored XSS vulnerabilities. The vulnerability compromises the integrity and confidentiality of affected Joomla sites using the vulnerable extension versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict builder user privileges to trusted individuals only and consider disabling the Quix Page Builder Pro extension if possible to reduce exposure.