CVE-2026-78077: Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complete contextual escaping, allowing injection of malicious HTML/JS. Stricter sanitization and tag allowlists via InputFilter and htmlspecialchars were implemented.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla Extension - joomshaper.com (MegaMenu Layout Container & Helix Ultimate)to a version that resolves this vulnerability.Fixed in 2.2.10
Event History
Frequently Asked Questions
Which installations are affected?
Installations using JoomShaper Helix Ultimate versions earlier than 2.2.10 are affected where MegaMenu layout container or embed input configuration is stored and rendered.
What does an attacker need to exploit this issue?
The attacker needs a way to supply malicious column or item configuration values that are saved in the MegaMenu layout JSON. Those values can then be rendered as malicious HTML or JavaScript because contextual escaping was incomplete.
What should be done to remediate the issue?
Upgrade Helix Ultimate to version 2.2.10 or later. The fix adds stricter sanitization, tag allowlists using InputFilter, and htmlspecialchars-based output escaping.