Advisories · Technology

joomshaper.com SP Page Builder extension for Joomla.

Every CVE that names joomshaper.com SP Page Builder extension for Joomla among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-67287 CVE record

CVSS 6.3 Medium

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0
- joomshaper.com SP Page Builder extension for Joomla
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-67286 CVE record

CVSS 6.3 Medium

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0
- joomshaper.com SP Page Builder extension for Joomla
- Path traversal
Not analysed yet 12 Aug 2026
CVE-2026-67285 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0
- joomshaper.com SP Page Builder extension for Joomla
- Path traversal
Not analysed yet 12 Aug 2026
CVE-2026-66494 CVE record

CVSS 8.7 High

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0
- joomshaper.com SP Page Builder extension for Joomla
- Cross-site scripting (XSS)
- Broken access control
Not analysed yet 7 Aug 2026
CVE-2026-65876 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0
- joomshaper.com SP Page Builder extension for Joomla
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-65877 CVE record

CVSS 8.2 High

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1
- joomshaper.com SP Page Builder extension for Joomla
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-65879 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1
- joomshaper.com SP Page Builder extension for Joomla
- Hard-coded credentials
Not analysed yet 27 Jul 2026
CVE-2026-65766 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1
- joomshaper.com SP Page Builder extension for Joomla
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-65878 CVE record

CVSS 8.3 High

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1
- joomshaper.com SP Page Builder extension for Joomla
- Path traversal
Not analysed yet 27 Jul 2026