PT-2026-61673 · Themexpert.Com · Quix Page Builder Pro Extension For Joomla

CVE-2026-60026 · Published 2026-07-20 · Updated 2026-07-20

Mitre

CVSS v4.0

8.9

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user (core.create/core.edit) could inject PHP tags in element content, that got executed via view-cache include(). Requires caching on (default).

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-60026

Affected Products

Quix Page Builder Pro Extension For Joomla

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-60026 · Security Note
• https://themexpert.com/quix-pagebuilder · Note