Medium · 6.1 CVE-2026-66490 EUVD-2026-50333GHSA-6432-frr4-pgf6

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

Published Jul 29, 2026 · Updated Aug 12, 2026 · Assigned by Joomla

Vendor: balbooa.com Product: Gridbox extension for Joomla Category: Web / CMS

Description

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

Affected products

Vendor	Product	Affected	Fixed
balbooa.com	Gridbox extension for Joomla	1.0.0-2.20.1	—

References

https://www.balbooa.com/gridbox product
https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/ third-party-advisory