Alex Joseph
A significant security vulnerability has been identified in Gridbox, a widely used drag-and-drop page builder for websites powered by Joomla. Developed by Balbooa.com, Gridbox allows users to create rich, interactive content. However, this particular flaw, tracked as a Stored Cross-Site Scripting (XSS) vulnerability and assigned CVE-2026-66490, posed a genuine risk to sites running older versions of the extension.
In simple terms, this vulnerability meant that a malicious actor could embed harmful code within a comment avatar—an image uploaded by a user in the comments section. Instead of just displaying as an image, this specially crafted avatar could execute arbitrary scripts in the web browser of anyone viewing the comment. Such an attack could lead to various undesirable outcomes, including the theft of user session data, which might allow attackers to hijack user accounts, deface the website, or redirect visitors to phishing sites. It highlights a critical need for website administrators and developers to ensure all components are secure and up-to-date.
CVE Details
Product: Gridbox (Joomla Extension by Balbooa.com)
CVE ID: CVE-2026-66490
Published: July 29, 2026
Severity: Medium
Status: Analyzed
Affected Products
This Stored Cross-Site Scripting vulnerability impacts all versions of the Gridbox extension for Joomla that are older than 2.20.2. This means any website running Gridbox from its initial release (version 1.0.0) up to and including version 2.20.1 is potentially vulnerable. Owners of these sites must take immediate action to protect their online presence.
Current Status
The vulnerability associated with CVE-2026-66490 has undergone thorough analysis, and its details have been openly communicated to raise awareness among affected users. It’s crucial to note that this XSS flaw is part of a larger set of vulnerabilities recently discovered in Gridbox, some of which have already been actively exploited in real-world attacks. While this particular XSS vulnerability is rated as Medium, the broader context of widespread exploitation across other related Gridbox issues underscores the urgency of addressing all known security gaps.
Severity Level
The severity of CVE-2026-66490 is classified as Medium, with a CVSS v3.1 score of 6.1. Stored XSS vulnerabilities are concerning because the malicious script is permanently embedded within the target application. This script then executes every time a user accesses the compromised data, without requiring a direct interaction with the attacker. The potential consequences of a successful XSS attack range widely, from session hijacking, which grants attackers access to legitimate user accounts, to injecting rogue content or defacing the website. In more severe cases, it could redirect users to malicious sites designed to steal credentials or install malware.
Possible Solutions
To safeguard your Joomla website, applying the available security updates for Gridbox is the most critical and immediate step. Balbooa has released fixes for this vulnerability in version 2.20.2. However, continuous security updates have been released since, so it is highly recommended to update your Gridbox extension to the absolute latest stable version available, such as 2.20.4.0 or newer, to benefit from all recent patches.
Follow these essential steps without delay:
- Update Gridbox Immediately: Access your Joomla administrator panel and navigate to the Extensions updater. Apply the update for Gridbox to version 2.20.2 or, even better, the latest stable release (e.g., 2.20.4.0). If you manage many sites, consider a tool that allows bulk updates.
- Perform a Full Backup: Before initiating any software updates, especially on a live production site, always create a complete backup of your website files and database. This ensures you can restore your site in case any unforeseen issues arise during the update process.
- Scan for Compromise: Due to the active exploitation of other Gridbox vulnerabilities, it is imperative to conduct a thorough scan of your website for signs of compromise. Look for newly created or suspicious administrator accounts, unexpected PHP files or scripts in your upload directories, or any recently modified files that you cannot account for. Tools designed for rogue admin detection and malware scanning can be invaluable here.
- Refresh Credentials: If your website was running a vulnerable version of Gridbox and was publicly accessible, assume that your site’s secrets might have been exposed. Change all administrator passwords and any other critical credentials. This helps prevent attackers who might have gained access from retaining it.
- Consider Temporary Disablement: For high-value websites where immediate patching isn’t possible, and if your site’s design can function without it, temporarily disable the Gridbox extension until you can perform the necessary updates securely.
References
https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/
https://www.balbooa.com/gridbox
https://www.balbooa.com/blog/gridbox/gridbox-2-20-2-security-release
https://www.balbooa.com/blog/gridbox/gridbox-2-20-2-3-bug-fixes-and-security-hardening
https://www.balbooa.com/blog/gridbox/gridbox-2-20-4-0-security-fixes
https://www.cve.org/CVERecord?id=CVE-2026-66490
