CVE-2026-78302: high-severity vulnerability in joomshaper.com SP Property extension for Joomla
Joomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.4%
Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without contextual escaping.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
joomshaper.com · SP Property extension for JoomlaRelated CVEs — joomshaper.com SP Property extension for Joomla
In the same product, most dangerous first.
CVE-2026-78082CRITICALJoomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4EPSS 0.5%CVE-2026-78085MEDIUMJoomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4EPSS 0.5%CVE-2026-78303MEDIUMJoomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4EPSS 0.4%CVE-2026-78084MEDIUMJoomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4EPSS 0.3%CVE-2026-78083HIGHJoomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4EPSS 0.2%