An unauthenticated stored Cross-Site Scripting vulnerability in the JoomShaper SP Property extension allows attackers to inject malicious scripts into administrative and frontend interfaces.

This is a stored Cross-Site Scripting (CWE-79) vulnerability where multiple template files fail to perform contextual escaping on input. This allows an unauthenticated attacker to inject malicious scripts that execute within the context of the victim's session, including administrative sessions.

Successful exploitation poses a significant risk to site integrity and administrative control. By injecting scripts into admin list tables, an attacker could hijack administrative sessions, perform unauthorized actions, or redirect users to malicious sites, leading to potential data compromise and loss of site control. With a CVSS score of 8.6, this high-severity vulnerability requires immediate attention to prevent unauthorized administrative access.

Immediate Action: Update the SP Property extension to version 4.1.4 or later as soon as the vendor release is available. If the update is not yet available, restrict access to the Joomla administrator panel to trusted IP addresses.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the extension, particularly those containing script tags or encoded HTML payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS protection rules to inspect and sanitize incoming traffic, which may block the injection of malicious payloads.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for administrative account compromise, organizations utilizing the SP Property extension must prioritize this issue. Administrators should monitor the JoomShaper website for the official release of version 4.1.4 and apply the patch immediately upon availability to mitigate the risk of persistent script injection.