Executive brief
Helix Ultimate is a free Joomla template widely used to build websites. An attacker with template editing access could inject malicious code into the MegaMenu layout configuration that would execute in the browsers of site administrators and visitors, potentially allowing account takeover, data theft, or site defacement.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the MegaMenu component of Helix Ultimate. Unsanitized column and item configuration values stored in the MegaMenu layout JSON are rendered without complete contextual HTML escaping, allowing injection of arbitrary HTML and JavaScript. An attacker with write access to template configuration can craft malicious payloads that persist in the template data and execute when administrators or site visitors load pages containing the MegaMenu. The fix implements stricter input sanitization and tag allowlists using Joomla's InputFilter class and htmlspecialchars() for contextual escaping. Versions prior to 2.2.10 are affected.
Affected products
- JoomShaper Helix Ultimate < 2.2.10
Timeline
- 2026-08-31: published: Advisory published on NVD