Quick answers
- Is CVE-2026-60031 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-60031 being exploited in the wild.
- How severe is CVE-2026-60031?
- Informational severity, with a CVSS score of 6.9, published 20 July 2026.
- Which products and versions are affected?
- ThemeXpert Quix Page Builder Pro 1.0-6.2.0.
- Is there a fix for CVE-2026-60031?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-60031 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-60031?
- Check whether you run ThemeXpert Quix Page Builder Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Quix Page Builder Pro extension for Joomla (versions 1.0 through 6.2.0) is vulnerable to CWE-200 (Information Exposure). The vulnerability exists within the AJAX handler component, which fails to properly sanitize or suppress error messages. When an exception occurs during an AJAX request, the system returns raw exception data in the response. A remote, unauthenticated attacker can exploit this by sending crafted requests to trigger these exceptions, potentially revealing sensitive system information, file paths, or configuration details. The issue was reported by the Joomla! Project with a CVSS 4.0 score of 6.9.
Affected products
- ThemeXpert Quix Page Builder Pro extension for Joomla 1.0-6.2.0
Timeline
- 2026-07-20: advisory: CVE published by the Joomla! Project