SP Page Builder extension for Joomla vulnerabilities

Product

SP Page Builder extension for Joomla

by joomshaper.com · last CVE Aug 12, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 4High 3Medium 2Low 0

Severity

Exploitation

Watch

Add SP Page Builder extension for Joomla to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-66494	8.7	0%	Aug 7	Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 Affected: 1.0.0-6.6.2
CVE-2026-65878	8.3	0%	Jul 27	Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1 Affected: 1.0.0-6.7.0
CVE-2026-65877	8.2	0%	Jul 27	Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 Affected: 1.0.0-6.7.0