A stored cross-site scripting (XSS) vulnerability exists in the Mega Menu Badge Text feature of the Helix Ultimate Joomla extension versions prior to 2.2.11. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The flaw is identified as CVE-2026-105602 and has a high severity rating with a CVSS score of 8.6.