CVE-2026-78302: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in joomshaper.com SP Property extension for Joomla

The SP Property extension for Joomla (versions 1.0.0 to 4.1.3) contains an unauthenticated stored cross-site scripting vulnerability caused by improper neutralization of input during web page generation (CWE-79). Multiple template files in frontend views and administrator list tables render attributes and text values directly into HTML without contextual escaping. This allows attackers to inject malicious scripts that execute in the context of users viewing the affected pages. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, and high impact on confidentiality and integrity.

An unauthenticated attacker can exploit this vulnerability to inject and store malicious scripts within the SP Property extension's frontend and admin interfaces. When other users load the affected pages, these scripts execute in their browsers, potentially leading to session hijacking, data theft, or other malicious actions. The vulnerability affects confidentiality and integrity with high severity.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory from joomshaper.com for current remediation guidance. Until a fix is available, consider restricting access to affected interfaces and monitoring for suspicious activity related to SP Property extension usage.