# JoomShaper vulnerabilities Source: https://junglewise.ai/threats/vendors/joomshaper Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/joomshaper.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 42 vulnerabilities in JoomShaper: 0 in the last 7 days and 28 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-105602, was published on 2 November 2026. 2 vulnerabilities in the last four weeks, down 87% on the four before (15). 5 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 28 - All time: 42 (1 critical, 1 exploited in the wild) ## About JoomShaper A software developer and provider of templates and extensions for the Joomla content management system. ## Latest JoomShaper vulnerabilities - [CVE-2026-105602: JoomShaper Helix Ultimate stored XSS in mega menu badge text](https://junglewise.ai/threats/cve-2026-105602-joomla-extension-joomshaper-com-stored-cross-site-scripting-xss) (info, published 2 Nov 2026) - [CVE-2026-103419: JoomShaper Helix Ultimate stored cross-site scripting in Media Picker](https://junglewise.ai/threats/cve-2026-103419-joomla-extension-joomshaper-com-stored-cross-site-scripting-xss) (info, published 2 Nov 2026) - [CVE-2026-102426: JoomShaper SP Page Builder Pro reflected XSS in Dynamic Content Filter](https://junglewise.ai/threats/cve-2026-102426-joomla-extension-joomshaper-com-reflected-xss-in-the-dynamic) (info, published 5 Oct 2026) - [CVE-2026-6806: The Motors plugin for WordPress SQL injection via stm_lat/stm_lng](https://junglewise.ai/threats/cve-2026-6806-the-motors-car-dealership-classified-listings-plugin-plugin-for) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-90905: Joomla Easy Store extension missing CSRF and access control](https://junglewise.ai/threats/cve-2026-90905-joomla-extension-joomshaper-com-missing-csrf-and-access-control) (info, published 23 Sep 2026) - [CVE-2026-90904: Joomla Easy Store extension access control bypass in ApiController](https://junglewise.ai/threats/cve-2026-90904-joomla-extension-joomshaper-com-broken-access-control-acl-bypass) (info, published 23 Sep 2026) - [CVE-2026-90903: Joomla Easy Store extension missing CSRF token verification in AJAX endpoints](https://junglewise.ai/threats/cve-2026-90903-joomla-extension-joomshaper-com-missing-csrf-token-verification) (info, published 23 Sep 2026) - [CVE-2026-90902: Joomla Easy Store SQL injection in coupon bulk update](https://junglewise.ai/threats/cve-2026-90902-joomla-extension-joomshaper-com-authenticated-privileged-sql) (info, published 23 Sep 2026) - [CVE-2026-90901: Joomla Easy Store SQL injection in media deletion](https://junglewise.ai/threats/cve-2026-90901-joomla-extension-joomshaper-com-authenticated-privileged-sql) (info, published 23 Sep 2026) - [CVE-2026-90900: Joomla Easy Store CSRF vulnerability in product review submission](https://junglewise.ai/threats/cve-2026-90900-joomla-extension-joomshaper-com-missing-csrf-token-verification) (info, published 23 Sep 2026) - [CVE-2026-90899: Joomla Easy Store insecure guest checkout IDOR](https://junglewise.ai/threats/cve-2026-90899-joomla-extension-joomshaper-com-unauthenticated-pii-exposure-via) (info, published 23 Sep 2026) - [CVE-2026-79701: JoomShaper SP Page Builder Pro CAPTCHA bypass in addons](https://junglewise.ai/threats/cve-2026-79701-joomshaper-sp-page-builder-pro-captcha-bypass-in-addons) (info, CVSS 7.5, published 14 Sep 2026) - [CVE-2026-81566: JoomShaper SP Page Builder missing access control in menu item creation](https://junglewise.ai/threats/cve-2026-81566-joomshaper-sp-page-builder-missing-access-control-in-menu-item) (info, published 14 Sep 2026) - [CVE-2026-81565: JoomShaper SP Page Builder arbitrary file upload directory traversal](https://junglewise.ai/threats/cve-2026-81565-joomshaper-sp-page-builder-arbitrary-file-upload-directory) (info, CVSS 7.5, published 14 Sep 2026) - [CVE-2026-81564: JoomShaper SP Page Builder arbitrary file rename via missing directory confinement](https://junglewise.ai/threats/cve-2026-81564-joomshaper-sp-page-builder-arbitrary-file-rename-via-missing) (info, published 14 Sep 2026) - [CVE-2026-79700: JoomShaper SP Page Builder Pro CAPTCHA bypass in optin_form addon](https://junglewise.ai/threats/cve-2026-79700-joomshaper-sp-page-builder-pro-captcha-bypass-in-optin-form-addon) (info, published 14 Sep 2026) - [CVE-2026-78375: JoomShaper SP Page Builder SQL injection in Content plugin](https://junglewise.ai/threats/cve-2026-78375-joomshaper-sp-page-builder-sql-injection-in-content-plugin) (info, CVSS 6.5, published 14 Sep 2026) - [CVE-2026-78085: JoomShaper SP Property path traversal in gallery image management](https://junglewise.ai/threats/cve-2026-78085-joomshaper-sp-property-path-traversal-in-gallery-image-management) (info, CVSS 0, published 10 Sep 2026) - [CVE-2026-78303: JoomShaper SP Property unvalidated email destination in booking forms](https://junglewise.ai/threats/cve-2026-78303-joomshaper-sp-property-unvalidated-email-destination-in-booking) (info, published 10 Sep 2026) - [CVE-2026-78302: JoomShaper SP Property stored XSS via unescaped output in views](https://junglewise.ai/threats/cve-2026-78302-joomshaper-sp-property-stored-xss-via-unescaped-output-in-views) (info, CVSS 6.5, published 10 Sep 2026) - [CVE-2026-78084: JoomShaper SP Property authorization bypass in gallery management](https://junglewise.ai/threats/cve-2026-78084-joomshaper-sp-property-authorization-bypass-in-gallery-management) (info, published 10 Sep 2026) - [CVE-2026-78083: JoomShaper SP Property CSRF token bypass in booking and contact forms](https://junglewise.ai/threats/cve-2026-78083-joomshaper-sp-property-csrf-token-bypass-in-booking-and-contact) (info, published 10 Sep 2026) - [CVE-2026-78082: JoomShaper SP Property unauthenticated SQL injection in search filtering](https://junglewise.ai/threats/cve-2026-78082-joomshaper-sp-property-unauthenticated-sql-injection-in-search) (info, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-78079: JoomShaper Helix Ultimate open redirect via Base64 return parameter](https://junglewise.ai/threats/cve-2026-78079-joomshaper-helix-ultimate-open-redirect-via-base64-return) (info, published 31 Aug 2026) - [CVE-2026-78078: JoomShaper Helix Ultimate privileged file upload bypass via content spoofing](https://junglewise.ai/threats/cve-2026-78078-joomshaper-helix-ultimate-privileged-file-upload-bypass-via) (info, published 31 Aug 2026) ## Most severe JoomShaper vulnerabilities - [CVE-2026-48908: JoomShaper SP Page Builder arbitrary file upload in Joomla](https://junglewise.ai/threats/cve-2026-48908-joomshaper-sp-page-builder-arbitrary-file-upload-in-joomla) (critical, exploited in the wild, CVSS 10, published 20 Jun 2026) - [CVE-2017-20266: Joomshaper SP Movie Database SQL injection in searchword parameter](https://junglewise.ai/threats/cve-2017-20266-joomshaper-sp-movie-database-sql-injection-in-searchword) (high, CVSS 8.2, published 19 Jun 2026) - [CVE-2026-6806: The Motors plugin for WordPress SQL injection via stm_lat/stm_lng](https://junglewise.ai/threats/cve-2026-6806-the-motors-car-dealership-classified-listings-plugin-plugin-for) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-48909: JoomShaper SP LMS remote code execution via cookie deserialization](https://junglewise.ai/threats/cve-2026-48909-joomshaper-sp-lms-remote-code-execution-via-cookie) (info, CVSS 9.5, published 20 Jun 2026) - [CVE-2026-65761: JoomShaper EasyStore SQL injection in product list sorting](https://junglewise.ai/threats/cve-2026-65761-joomshaper-easystore-sql-injection-in-product-list-sorting) (info, CVSS 9.3, published 23 Jul 2026) - [CVE-2026-65876: JoomShaper SP Page Builder SQL injection in loadMoreArticles](https://junglewise.ai/threats/cve-2026-65876-joomshaper-sp-page-builder-sql-injection-in-loadmorearticles) (info, CVSS 9.2, published 27 Jul 2026) - [CVE-2026-65766: JoomShaper SP Page Builder SQL injection in Dynamic Content endpoint](https://junglewise.ai/threats/cve-2026-65766-joomshaper-sp-page-builder-sql-injection-in-dynamic-content) (info, CVSS 9.2, published 27 Jul 2026) - [CVE-2026-65760: JoomShaper Easy Store improper access control in order views](https://junglewise.ai/threats/cve-2026-65760-joomshaper-easy-store-improper-access-control-in-order-views) (info, CVSS 9.2, published 23 Jul 2026) - [CVE-2026-57830: JoomShaper Helix Ultimate unauthenticated arbitrary file deletion](https://junglewise.ai/threats/cve-2026-57830-joomshaper-helix-ultimate-unauthenticated-arbitrary-file-deletion) (info, CVSS 8.8, published 13 Jul 2026) - [CVE-2026-65759: JoomShaper Easy Store unauthenticated order forgery in checkout repay task](https://junglewise.ai/threats/cve-2026-65759-joomshaper-easy-store-unauthenticated-order-forgery-in-checkout) (info, CVSS 8.7, published 23 Jul 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, down 87% on the four before (15). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 5 | 0 | 0 | | 7 Sep 2026 | 6 | 0 | 0 | | 14 Sep 2026 | 6 | 0 | 0 | | 21 Sep 2026 | 7 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## JoomShaper technologies - [JoomShaper SP Page Builder](https://junglewise.ai/threats/technologies/sp-page-builder): 10 vulnerabilities - [JoomShaper Easy Store](https://junglewise.ai/threats/technologies/easy-store): 9 vulnerabilities - [JoomShaper Helix-Ultimate](https://junglewise.ai/threats/technologies/helix-ultimate): 9 vulnerabilities - [JoomShaper SP Property](https://junglewise.ai/threats/technologies/sp-property): 6 vulnerabilities - [JoomShaper SP Page Builder Pro](https://junglewise.ai/threats/technologies/sp-page-builder-pro): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "JoomShaper vulnerabilities", https://junglewise.ai/threats/vendors/joomshaper, 10 November 2026.