New CVE: CVE-2026-102800 — joomla! (HIGH, 8.7)
Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field to its AJAX handlers (getDeny, getConfirm, getDenyReason in mod_djhelpful_articles/helper.php), reachable without authentication through com_ajax. The value was stored… [HIGH]
https://nvd.nist.gov/vuln/detail/CVE-2026-102800