{"id":"CVE-2026-102426","published":"2026-10-05T16:17:04.017","lastModified":"2026-10-06T15:05:34.080","description":"Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter \"l-r\", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}