CVE-2026-66490 is a stored cross-site scripting vulnerability in the Gridbox extension for Joomla by balbooa.com. The vulnerability arises from improper neutralization of input during web page generation, specifically via a comment avatar. This allows an attacker to inject and store malicious scripts that execute when viewed by other users. The affected versions include all releases from 1.0.0 up to and including 2.20.1. No official patch or remediation level has been published as of the current data.

Successful exploitation of this vulnerability could lead to the execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or conduct other malicious activities. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of the comment avatar feature in Gridbox or applying any available workarounds recommended by the vendor. Monitor official balbooa.com and Joomla advisories for updates.