{"affected":[{"defaultStatus":"unaffected","product":"Advanced Custom Fields extension for Joomla","source":"CNA: Joomla","vendor":"tassos.gr","versions":[{"status":"affected","version":"3.0.0-3.1.8"},{"status":"affected","version":"2.8.2-2.8.15"}]},{"defaultStatus":"unaffected","product":"Smile Pack extension for Joomla","source":"CNA: Joomla","vendor":"tassos.gr","versions":[{"status":"affected","version":"2.0.0-2.1.6"},{"status":"affected","version":"1.1.2-1.2.9"}]}],"cveId":"CVE-2026-115452","cwes":["CWE-79"],"description":"Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: Joomla","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/S:N/AU:N","version":"4.0"},{"score":6.7,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","version":"3.1"}],"modifiedAt":1793908703067,"publishedAt":1793901081362,"references":[{"source":"CNA: Joomla","tags":["product"],"url":"https://www.tassos.gr/"}],"remediation":[],"revision":"26c13acfb221118895122a658728494ce9013532654449d7d5c3f7eb37780291","sources":[{"modifiedAt":1793908703067,"name":"CNA: Joomla","retrievedAt":1793909579806,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115452"}],"ssvc":{"assessedAt":1793908698695,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6","updatedAt":1793909579806}