| Package | Affected versions | Patched versions |
|---|---|---|
| sp page builder | = 5.6.1≥ 3.0.0, < 5.6.1 | 5.6.1 |
Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free