CVE-2026-60029 is an authenticated stored XSS vulnerability in the themexpert.com Quix Page Builder Pro Joomla extension prior to version 6.2.1. Authenticated builder users can inject malicious scripts by manipulating id/class fields that are rendered on public-facing pages, allowing script execution in the context of site visitors. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). No official patch or remediation level is currently stated in the vendor or CVE data.

Successful exploitation allows authenticated builder users to inject persistent malicious scripts that execute in the browsers of public users visiting affected pages. This can lead to session hijacking, defacement, or other client-side attacks. The vulnerability requires authenticated access with builder privileges, limiting the attacker scope. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict builder user privileges to trusted personnel only and monitor for suspicious activity. Avoid exposing id/class input fields to untrusted input. Follow vendor updates closely for an official fix.