# CVE-2026-102426: JoomShaper SP Page Builder Pro reflected XSS in Dynamic Content Filter

Source: https://junglewise.ai/threats/cve-2026-102426-joomla-extension-joomshaper-com-reflected-xss-in-the-dynamic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-102426 · Severity: info · Published 2026-10-05

SP Page Builder Pro is a drag-and-drop page composer extension for Joomla that allows website builders to create pages visually. The Dynamic Content Filter addon contains a reflected cross-site scripting vulnerability that allows an attacker to inject malicious JavaScript into a webpage through a crafted URL parameter. An unauthenticated attacker could trick users into visiting a malicious link and steal session cookies, credentials, or perform actions on behalf of the victim.

Technologies: [JoomShaper SP Page Builder Pro](https://junglewise.ai/threats/technologies/sp-page-builder-pro). Vendors: [JoomShaper](https://junglewise.ai/threats/vendors/joomshaper).

## Quick answers

**Is CVE-2026-102426 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102426 being exploited in the wild.

**How severe is CVE-2026-102426?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** JoomShaper SP Page Builder Pro 3.0.0 to 5.6.1p2.

**Is there a fix for CVE-2026-102426?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102426 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102426?** Check whether you run JoomShaper SP Page Builder Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Dynamic Content Filter addon where slider minimum and maximum values from the dc_filter_<fieldId> request parameter are parsed, HTML-escaped for the data-value attribute, but then output unescaped as span element text content. An unauthenticated attacker can inject arbitrary HTML or JavaScript through a crafted dc_filter_<fieldId> parameter value via reflected XSS. The vulnerability affects versions 3.0.0 through 5.6.1p2.

## Affected products

- JoomShaper SP Page Builder Pro 3.0.0 to 5.6.1p2

## Timeline

- 2026-10-05: disclosed

## References

- [https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro](https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro)

## Related threats

- [JoomShaper SP Page Builder Pro CAPTCHA bypass in addons](https://junglewise.ai/threats/cve-2026-79701-joomshaper-sp-page-builder-pro-captcha-bypass-in-addons)
- [JoomShaper SP Page Builder arbitrary file upload directory traversal](https://junglewise.ai/threats/cve-2026-81565-joomshaper-sp-page-builder-arbitrary-file-upload-directory)
- [JoomShaper SP Page Builder Pro CAPTCHA bypass in optin_form addon](https://junglewise.ai/threats/cve-2026-79700-joomshaper-sp-page-builder-pro-captcha-bypass-in-optin-form-addon)