Themexpert.com vulnerabilities
We track 7 vulnerabilities in Themexpert.com products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on July 20, 2026.
Latest Themexpert.com vulnerabilities
- 9.4 Critical severity
JMedia extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS.
- 9.4 Critical severity
JMedia extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmo
- 8.7 High severity
Quix Page Builder Pro extension for Joomla: Improper Access Control
Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of the
- 8.6 High severity
Quix Page Builder Pro extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any vi
- 8.7 High severity
Quix Page Builder Pro extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users a
- 8.9 High severity
Quix Page Builder Pro extension for Joomla: Improper Control of Generation of Code
Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user (core.create/core.edit) could inject
- 8.7 High severity
Quix Page Builder Pro extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an unauthenticated SQL injection.