Executive brief
Page Builder CK is a popular Joomla extension that enables site administrators to build and manage web page layouts using a drag-and-drop interface. A reflected cross-site scripting (XSS) vulnerability in the iscontenttype parameter allows attackers to inject malicious scripts into pages, which can be used to steal user session tokens, deface content, or harvest login credentials from unsuspecting site visitors.
Technical details
This is a reflected XSS vulnerability in the Page Builder CK Joomla extension, exploitable via the iscontenttype parameter. The vulnerable component fails to properly sanitize or validate user-supplied input before reflecting it back in the HTTP response. An attacker can craft a malicious URL containing JavaScript code in the iscontenttype parameter and trick a user into clicking it; the unvalidated input is then executed in the victim's browser within the context of the Joomla application. No authentication or special privileges appear to be required to exploit this vulnerability. Versions prior to 3.6.5 are affected; a patch is available in version 3.6.5 or later.
Affected products
- JoomlaCK Page Builder CK < 3.6.5
Timeline
- 2026-08-24: disclosed