CVE-2026-77027: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in fabrikar.com Fabrik extension for Joomla

This vulnerability (CWE-79) affects the Fabrik extension for Joomla, specifically versions from 1.0.0 up to and including 4.7.1. The issue is due to improper neutralization of input during web page generation in the jsactions feature, which leads to an unauthenticated stored XSS vector. The CVSS 4.0 base score is 8.6, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality and integrity highly, with low impact on availability. No official remediation or patch information is provided in the available data.

Successful exploitation allows unauthenticated attackers to inject and store malicious scripts that execute in the context of users' browsers, potentially leading to session hijacking, defacement, or other malicious actions impacting confidentiality and integrity of user data. The vulnerability does not require privileges or authentication to exploit but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the jsactions feature if possible, or apply any recommended temporary mitigations from the vendor. Monitor official Fabrik and Joomla advisories for updates.