CVE-2026-78077

Helix Ultimate, JoomShaper's widely used Joomla template framework, prior to version 2.2.10 stores MegaMenu column and item configuration values without full sanitization and renders that stored layout JSON without complete contextual escaping, enabling stored cross-site scripting (CWE-79). An attacker with administrator-level privileges (CVSS 4.0 PR:High) can save malicious HTML or JavaScript into MegaMenu container or embed configuration fields, and the payload then executes whenever those stored values are rendered, with no additional user interaction required. Successful injection yields arbitrary JavaScript execution in the site's context, with high confidentiality and integrity impact per the 8.6 High CVSS 4.0 score, which can be used to hijack admin sessions, alter content, or persist a foothold in the backend. Any Joomla site running Helix Ultimate versions before 2.2.10 is affected, particularly sites with multiple or third-party administrators. No public proof-of-concept or known exploitation has been reported; EPSS is 0.3% (19th percentile) and the issue is not in CISA KEV.

What to do: Upgrade Helix Ultimate to version 2.2.10 or later, which adds InputFilter sanitization with tag allowlists and htmlspecialchars contextual escaping. Until patched, review MegaMenu layout, container, and embed configuration values for unexpected HTML or scripts and remove any injected markup. Because exploitation requires administrator-level access, audit administrator accounts and rotate credentials if admin compromise is suspected.