helix_ultimate_extension_for_joomla vulnerabilities
CVEs whose affected-version data names the helix_ultimate_extension_for_joomla package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-103419High· 8.6Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.
▾ Twilightjoomshaper.com · Helix Ultimate extension for JoomlaEPSS 0.36%via CVEORG
CVE-2026-105602High· 8.6Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.
▾ Twilightjoomshaper.com · Helix Ultimate extension for JoomlaEPSS 0.36%via CVEORG
CVE-2026-78077High· 8.6Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were …
▾ Twilightjoomshaper.com · Helix Ultimate extension for JoomlaEPSS 0.42%via CVEORG