{"affected":[{"defaultStatus":"unaffected","product":"Helix Ultimate extension for Joomla","source":"CNA: Joomla","vendor":"joomshaper.com","versions":[{"status":"affected","version":"1.0-2.2.10"}]}],"cveId":"CVE-2026-78077","cwes":["CWE-79"],"description":"Joomla Extension - joomshaper.com -  Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complete contextual escaping, allowing injection of malicious HTML/JS. Stricter sanitization and tag allowlists via `InputFilter` and `htmlspecialchars` were implemented.","epss":{"date":"2026-11-01","percentile":0.36096,"score":0.00418},"exploits":[],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: Joomla","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793625789137,"publishedAt":1788184423475,"references":[{"source":"CNA: Joomla","tags":["product"],"url":"https://www.joomshaper.com/joomla-templates/helixultimate"}],"remediation":[],"revision":"545d87155729234d23380640977cf20bea909fb41486a5aaecdc80fb99b983ad","sources":[{"modifiedAt":1793625789137,"name":"CNA: Joomla","retrievedAt":1793628546546,"url":"https://www.cve.org/CVERecord?id=CVE-2026-78077"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793628559019,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78077"}],"ssvc":{"assessedAt":1788186318487,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Joomla Extension - joomshaper.com -  Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11","updatedAt":1793628559019}