CVE-2026-105607: Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0

Gridbox installations below version 2.20.5.0 are affected where the Recent Comments or Recent Reviews widget is in use.

No. The vulnerability is unauthenticated, and the vector indicates no privileges are required.

The attacker can target the vulnerable service over the network with low attack complexity. User interaction is required for the XSS impact to occur.

No. The stated affected range is versions earlier than 2.20.5.0.

Published Nov 5, 2026

Updated

Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0

Event History

Nov 5, 2026

CVE Published

via MITRE·05:51 PM

Data Sourced

via MITRE·05:51 PM

DescriptionWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeakness

Gridbox installations below version 2.20.5.0 are affected where the Recent Comments or Recent Reviews widget is in use.

No. The vulnerability is unauthenticated, and the vector indicates no privileges are required.

The attacker can target the vulnerable service over the network with low attack complexity. User interaction is required for the XSS impact to occur.

No. The stated affected range is versions earlier than 2.20.5.0.