# joomshaper.com Helix Ultimate extension for Joomla.

Every CVE that names joomshaper.com Helix Ultimate extension for Joomla among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.](https://agentprime.io/advisories/CVE-2026-103419.md)
  `CVE-2026-103419` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.](https://agentprime.io/advisories/CVE-2026-105602.md)
  `CVE-2026-105602` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10](https://agentprime.io/advisories/CVE-2026-78075.md)
  `CVE-2026-78075` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Broken access control
- [Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10](https://agentprime.io/advisories/CVE-2026-78076.md)
  `CVE-2026-78076` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Broken access control
- [Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10](https://agentprime.io/advisories/CVE-2026-78078.md)
  `CVE-2026-78078` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 8.9 High · Not analysed yet · Published 31 Aug 2026 · Tags: Unrestricted file upload
- [Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11](https://agentprime.io/advisories/CVE-2026-78077.md)
  `CVE-2026-78077` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10](https://agentprime.io/advisories/CVE-2026-78079.md)
  `CVE-2026-78079` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Open redirect
- [Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7](https://agentprime.io/advisories/CVE-2026-57830.md)
  `CVE-2026-57830` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 8.8 High · Not analysed yet · Published 13 Jul 2026 · Tags: Broken access control
- [Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7](https://agentprime.io/advisories/CVE-2026-57829.md)
  `CVE-2026-57829` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 13 Jul 2026 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=joomshaper-com-helix-ultimate-extension-for-joomla>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/joomshaper-com-helix-ultimate-extension-for-joomla/>. Everything for agents: <https://agentprime.io/llms.txt>.