# JoomShaper Helix-Ultimate vulnerabilities Source: https://junglewise.ai/threats/technologies/helix-ultimate Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/helix-ultimate.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 9 vulnerabilities in JoomShaper Helix-Ultimate: 0 in the last 7 days and 7 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-105602, was published on 2 November 2026. 2 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 7 - All time: 9 (0 critical, 0 exploited in the wild) ## About JoomShaper Helix-Ultimate Helix Ultimate is a template framework for the Joomla content management system. ## Latest JoomShaper Helix-Ultimate vulnerabilities - [CVE-2026-105602: JoomShaper Helix Ultimate stored XSS in mega menu badge text](https://junglewise.ai/threats/cve-2026-105602-joomla-extension-joomshaper-com-stored-cross-site-scripting-xss) (info, published 2 Nov 2026) - [CVE-2026-103419: JoomShaper Helix Ultimate stored cross-site scripting in Media Picker](https://junglewise.ai/threats/cve-2026-103419-joomla-extension-joomshaper-com-stored-cross-site-scripting-xss) (info, published 2 Nov 2026) - [CVE-2026-78079: JoomShaper Helix Ultimate open redirect via Base64 return parameter](https://junglewise.ai/threats/cve-2026-78079-joomshaper-helix-ultimate-open-redirect-via-base64-return) (info, published 31 Aug 2026) - [CVE-2026-78078: JoomShaper Helix Ultimate privileged file upload bypass via content spoofing](https://junglewise.ai/threats/cve-2026-78078-joomshaper-helix-ultimate-privileged-file-upload-bypass-via) (info, published 31 Aug 2026) - [CVE-2026-78077: JoomShaper Helix Ultimate stored XSS in MegaMenu layout](https://junglewise.ai/threats/cve-2026-78077-joomshaper-helix-ultimate-stored-xss-in-megamenu-layout) (info, published 31 Aug 2026) - [CVE-2026-78076: JoomShaper Helix Ultimate broken access control in MegaMenu settings](https://junglewise.ai/threats/cve-2026-78076-joomshaper-helix-ultimate-broken-access-control-in-megamenu) (info, published 31 Aug 2026) - [CVE-2026-78075: JoomShaper Helix Ultimate broken object-level authorization in blog image deletion](https://junglewise.ai/threats/cve-2026-78075-joomshaper-helix-ultimate-broken-object-level-authorization-in) (info, published 31 Aug 2026) - [CVE-2026-57830: JoomShaper Helix Ultimate unauthenticated arbitrary file deletion](https://junglewise.ai/threats/cve-2026-57830-joomshaper-helix-ultimate-unauthenticated-arbitrary-file-deletion) (info, CVSS 8.8, published 13 Jul 2026) - [CVE-2026-57829: JoomShaper Helix Ultimate unauthenticated stored XSS](https://junglewise.ai/threats/cve-2026-57829-joomshaper-helix-ultimate-unauthenticated-stored-xss) (info, CVSS 8.7, published 13 Jul 2026) ## Most severe JoomShaper Helix-Ultimate vulnerabilities - [CVE-2026-57830: JoomShaper Helix Ultimate unauthenticated arbitrary file deletion](https://junglewise.ai/threats/cve-2026-57830-joomshaper-helix-ultimate-unauthenticated-arbitrary-file-deletion) (info, CVSS 8.8, published 13 Jul 2026) - [CVE-2026-57829: JoomShaper Helix Ultimate unauthenticated stored XSS](https://junglewise.ai/threats/cve-2026-57829-joomshaper-helix-ultimate-unauthenticated-stored-xss) (info, CVSS 8.7, published 13 Jul 2026) - [CVE-2026-78078: JoomShaper Helix Ultimate privileged file upload bypass via content spoofing](https://junglewise.ai/threats/cve-2026-78078-joomshaper-helix-ultimate-privileged-file-upload-bypass-via) (info, published 31 Aug 2026) - [CVE-2026-78077: JoomShaper Helix Ultimate stored XSS in MegaMenu layout](https://junglewise.ai/threats/cve-2026-78077-joomshaper-helix-ultimate-stored-xss-in-megamenu-layout) (info, published 31 Aug 2026) - [CVE-2026-78079: JoomShaper Helix Ultimate open redirect via Base64 return parameter](https://junglewise.ai/threats/cve-2026-78079-joomshaper-helix-ultimate-open-redirect-via-base64-return) (info, published 31 Aug 2026) - [CVE-2026-78076: JoomShaper Helix Ultimate broken access control in MegaMenu settings](https://junglewise.ai/threats/cve-2026-78076-joomshaper-helix-ultimate-broken-access-control-in-megamenu) (info, published 31 Aug 2026) - [CVE-2026-78075: JoomShaper Helix Ultimate broken object-level authorization in blog image deletion](https://junglewise.ai/threats/cve-2026-78075-joomshaper-helix-ultimate-broken-object-level-authorization-in) (info, published 31 Aug 2026) - [CVE-2026-105602: JoomShaper Helix Ultimate stored XSS in mega menu badge text](https://junglewise.ai/threats/cve-2026-105602-joomla-extension-joomshaper-com-stored-cross-site-scripting-xss) (info, published 2 Nov 2026) - [CVE-2026-103419: JoomShaper Helix Ultimate stored cross-site scripting in Media Picker](https://junglewise.ai/threats/cve-2026-103419-joomla-extension-joomshaper-com-stored-cross-site-scripting-xss) (info, published 2 Nov 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 5 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other JoomShaper technologies - [JoomShaper SP Page Builder](https://junglewise.ai/threats/technologies/sp-page-builder): 10 vulnerabilities - [JoomShaper Easy Store](https://junglewise.ai/threats/technologies/easy-store): 9 vulnerabilities - [JoomShaper SP Property](https://junglewise.ai/threats/technologies/sp-property): 6 vulnerabilities - [JoomShaper SP Page Builder Pro](https://junglewise.ai/threats/technologies/sp-page-builder-pro): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "JoomShaper Helix-Ultimate vulnerabilities", https://junglewise.ai/threats/technologies/helix-ultimate, 10 November 2026.