Joomshaper.com vulnerabilities
We track 25 vulnerabilities in Joomshaper.com products across 6 products. 25 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2026.
Latest Joomshaper.com vulnerabilities
- 7.2 High severity
Easy Store extension for Joomla: Improper Access Control
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core Joomla mail configu
- 8.6 High severity
Easy Store extension for Joomla: Improper Access Control
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level AC
- 7.2 High severity
Easy Store extension for Joomla: Cross-Site Request Forgery
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products() action. All other administrative
- 8.6 High severity
Easy Store extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) took input IDs and d
- 8.6 High severity
Easy Store extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter
- 8.2 High severity
Easy Store extension for Joomla: Exposure of Sensitive Information to an Unauthorized Actor
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server ret
- 7.0 High severity
SP Page Builder (Free and Pro) extension for…: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operati
- 8.6 High severity
SP Page Builder (Free and Pro) extension for…: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave() read jform[attribs][sppagebuilder_article_id] from the request and
- 8.6 High severity
SP Property extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and tex
- 7.1 High severity
SP Property extension for Joomla: Cross-Site Request Forgery
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4 - The visitor booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints processed POST r
- 9.3 Critical severity
SP Property extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses (zipcode, sorting, price_range_dropdown,
- 8.9 High severity
Helix Ultimate extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uplo
- 8.6 High severity
Helix Ultimate extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complet
- 9.2 Critical severity
SP Page Builder extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.
- 8.7 High severity
SP Page Builder extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP
- 9.8 Critical severity
SP Page Builder extension for Joomla: Use of Hard-coded Credentials
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.
- 8.3 High severity
SP Page Builder extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager.
- 8.2 High severity
SP Page Builder extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector.
- 9.2 Critical severity
SP Page Builder extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.
- 9.2 Critical severity
SP Page Builder extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector.
- 9.3 Critical severity
Easy Store extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessio
- 9.2 Critical severity
Easy Store extension for Joomla: Exposure of Sensitive Information to an Unauthorized Actor
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.
- 8.7 High severity
Easy Store extension for Joomla: Improper Access Control
Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate pay
- 9.1 Critical severity
Helix Ultimate extension for Joomla: Missing Authorization
Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion.
- 7.5 High severity
Helix3 extension for Joomla: Improper Access Control
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.