CVE-2026-78303: medium-severity vulnerability in joomshaper.com SP Property extension for Joomla
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.4%
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
joomshaper.com · SP Property extension for JoomlaRelated CVEs — joomshaper.com SP Property extension for Joomla
In the same product, most dangerous first.
CVE-2026-78082CRITICALJoomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4EPSS 0.5%CVE-2026-78085MEDIUMJoomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4EPSS 0.5%CVE-2026-78302HIGHJoomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4EPSS 0.4%CVE-2026-78084MEDIUMJoomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4EPSS 0.3%CVE-2026-78083HIGHJoomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4EPSS 0.2%