CVE-2026-78077: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in joomshaper.com Helix Ultimate extension for Joomla

CVE-2026-78077 is a stored cross-site scripting vulnerability (CWE-79) in the Helix Ultimate extension for Joomla by joomshaper.com. Versions from 1.0 up to and including 2.2.9 are affected. The issue arises because column and item configuration values in the MegaMenu layout JSON are not fully escaped when rendered, enabling attackers to inject malicious HTML or JavaScript code. The vendor has implemented stricter sanitization and tag allowlists via InputFilter and htmlspecialchars to mitigate this issue.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of users viewing the affected MegaMenu layouts. This can lead to session hijacking, unauthorized actions, or other malicious activities within the Joomla site. The CVSS 4.0 base score is 8.6 (high severity), indicating a significant risk if exploited.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor joomshaper.com and Joomla advisories for updates and apply any official fixes once available. Until then, restricting administrative access and reviewing MegaMenu configurations for suspicious inputs may reduce risk.