← CVE Radar
CVE-2026-115452Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6
Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker.
7.5 HIGHEPSS 0.35%Not in KEVNVD: Awaiting Analysis
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.5 | HIGH | 4.0Joomla (CNA) | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/S:N/AU:N |
| 6.7 | MEDIUM | 3.1CISA-ADP | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L |
Details
- CVE ID
- CVE-2026-115452
- Status
- Awaiting Analysis
- Assigner (CNA)
- Joomla
- Published
- Nov 5, 2026
- Last modified
- 2026-11-06 20:20 UTC
- Weaknesses
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
As published by the CNA in the CVE record.
tassos.grAdvanced Custom Fields extension for Joomla2 version ranges
- 3.0.0-3.1.8
- 2.8.2-2.8.15
tassos.grSmile Pack extension for Joomla2 version ranges
- 2.0.0-2.1.6
- 1.1.2-1.2.9