Description

Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-11-05T18:17:01.890Z",
  "pubdate": "2026-11-05T18:17:01.890Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists within the Advanced Custom Fields and Smile Pack extensions for Joomla, developed by tassos.gr. The flaw stems from improper neutralization of user-supplied input when defining Map marker labels. An authenticated user, such as an article author with sufficient privileges to modify these fields, can inject arbitrary JavaScript payloads. When triggered, these malicious scripts execute within the context of the victim's browser session upon viewing the affected marker. This vulnerability poses a significant risk to administrative integrity and user session security. Successful exploitation allows an attacker to execute unauthorized actions, capture sensitive session cookies, or redirect users to malicious domains. The vulnerability affects Advanced Custom Fields versions 2.8.2-2.8.15 and 3.0.0-3.1.8, as well as Smile Pack versions 1.1.2-1.2.9 and 2.0.0-2.1.6. Remediation requires an immediate update to the latest available versions provided by the vendor to ensure proper input sanitization and output encoding.",
  "technicalDetails": "The vulnerability is a classic Stored Cross-Site Scripting (XSS) flaw localized within the input handling logic of the Map marker configuration interface. In both the Advanced Custom Fields and Smile Pack extensions, the application fails to adequately sanitize or encode user-provided text destined for rendering within Map marker labels. The root cause is the lack of context-aware output encoding on the server-side, which permits the storage of HTML tags containing JavaScript event handlers or script tags directly into the underlying database.\nThe attack flow begins when an attacker, possessing at least 'author' level privileges—or any role permitted to manage Map markers—accesses the extension configuration interface. During the creation or modification of a Map marker, the attacker injects a malicious payload into the label input field. Common payloads utilize event handlers such as 'onmouseover' or traditional '<script>' tags designed to execute arbitrary code when the marker element is rendered on the frontend.\nOnce the malicious input is persisted in the database, the extension's rendering engine retrieves and outputs the unsanitized string into the document object model (DOM) of the page where the Map is displayed. Because the application does not implement adequate Content Security Policy (CSP) headers or perform output sanitization prior to rendering, the browser interprets the attacker's input as executable code rather than plain text. Consequently, any user who views the page containing the malicious marker—including administrative users—executes the payload within their authenticated session context.\nThe post-exploitation impact is severe. Because the script executes with the privileges of the viewing user, an attacker can perform actions such as modifying user account details, creating new administrative accounts, or intercepting sensitive data including session tokens, which could lead to a full site takeover. The exploitation does not require advanced network-level access, as it relies on the browser's trust in the server-provided content. The scope of the vulnerability is limited to the functionality of the map markers, but the impact is elevated by the potential to compromise users with higher administrative privileges, effectively turning the XSS into a vector for privilege escalation."
}