Joomshaper.com Helix Ultimate Extension For Joomla
7 CVEs affecting Joomshaper.com Helix Ultimate Extension For Joomla. Latest disclosed: 2026-08-31. Critical: 1, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57830 | Critical | 9.1 | 2026-07-13 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an… |
CVE-2026-57829 | Medium | 6.1 | 2026-07-13 | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthentica… |
CVE-2026-78079 | | 2026-08-31 | Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64… | |
CVE-2026-78078 | | 2026-08-31 | Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only fil… | |
CVE-2026-78077 | | 2026-08-31 | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized col… | |
CVE-2026-78076 | | 2026-08-31 | Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-mega… | |
CVE-2026-78075 | | 2026-08-31 | Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whethe… |