# CVE-2026-105607: Joomla Gridbox stored XSS in Recent Comments widget

Source: https://junglewise.ai/threats/cve-2026-105607-joomla-extension-balbooa-com-unauthenticated-stored-xss-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-105607 · Severity: info · Published 2026-11-05

Gridbox is a website builder extension for Joomla that allows users to create and manage websites without coding. The vulnerability allows unauthenticated attackers to inject malicious scripts into the Recent Comments or Recent Reviews widget, which can execute in the browsers of site visitors. This could lead to account hijacking, data theft, or defacement depending on what actions the injected script performs.

Technologies: [Balbooa.Com Gridbox](https://junglewise.ai/threats/technologies/balbooa-com-gridbox). Vendors: [Balbooa.Com](https://junglewise.ai/threats/vendors/balbooa-com).

## Quick answers

**Is CVE-2026-105607 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105607 being exploited in the wild.

**How severe is CVE-2026-105607?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** Balbooa.Com Gridbox < 2.20.5.0.

**Is there a fix for CVE-2026-105607?** Yes: fixed in Gridbox 2.20.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105607 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105607?** Check whether you run Balbooa.Com Gridbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Gridbox 2.20.5.0

## Technical details

An unauthenticated stored cross-site scripting (XSS) vulnerability exists in the Recent Comments/Recent Reviews widget component of Gridbox. The vulnerability allows attackers to inject and persist malicious JavaScript that executes when the widget is displayed to other users. This requires the widget to be active and displayed on the site, but does not require prior authentication or user interaction beyond normal site browsing.

## Affected products

- balbooa.com Gridbox < 2.20.5.0

## Timeline

- 2026-11-05: disclosed

## References

- [https://www.balbooa.com/gridbox](https://www.balbooa.com/gridbox)

## Related threats

- [balbooa Gridbox unauthenticated file deletion](https://junglewise.ai/threats/cve-2026-107130-joomla-extension-balbooa-com-unauthenticated-deletion-of)
- [Joomla Gridbox missing authorization check in editor controller](https://junglewise.ai/threats/cve-2026-102789-joomla-extension-balbooa-com-missing-authorization-check-on)