CVE-2026-60029 is an authenticated stored XSS vulnerability in the Quix Page Builder Pro extension for Joomla by themexpert.com. Authenticated builder users can exploit improper neutralization of input during web page generation by injecting scripts through id/class fields, which are then rendered to public users. This vulnerability affects versions =1.0-6.2.0. There is no official patch or remediation level currently documented.

Successful exploitation allows authenticated builder users to execute arbitrary scripts in the context of public users visiting the affected Joomla site. This can lead to session hijacking, defacement, or other malicious actions impacting site visitors. The vulnerability requires authenticated access with builder privileges, limiting the attack surface to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict builder user privileges to trusted personnel only and monitor for suspicious activity. Avoid granting builder access to untrusted users. Follow vendor updates for any forthcoming patches.