CVE-2026-77993: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in joomlack.fr Page Builder CK extension for Joomla

CVE-2026-77993 describes a reflected XSS vulnerability in the Page Builder CK extension for Joomla, specifically in versions 1.0.0 through 3.6.4. The issue arises from improper neutralization of input during web page generation, where the iscontenttype parameter is not properly sanitized, allowing injection of malicious scripts. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating a network attack vector with low complexity and no privileges required, but user interaction is needed. There are no known exploits in the wild and no official patch or remediation details provided in the input data.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, the impact is limited by the need for user interaction and the reflected nature of the XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the vulnerable parameter if possible and apply standard XSS mitigations such as input validation and output encoding in their environment.