High severity · published Sep 10, 2026
CVE-2026-78302
Joomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without contextual escaping.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
SP Property extension for Joomla · joomshaper.com
1.0.0-4.1.3 · source: vendor
Affected product
SP
SP Property extension for Joomla
joomshaper.com
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78302
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78302
www.joomshaper.com
https://www.joomshaper.com/joomla-extensions/sp-property
More from SP Property extension for Joomla
9.3
CVE-2026-78082
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4
7.1
CVE-2026-78083
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4
6.9
CVE-2026-78085
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4
6.9
CVE-2026-78084
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4
6.9
CVE-2026-78303
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4