High severity · published Jul 18, 2025
CVE-2025-49486
Extension - balbooa.com - Stored XSS in Balbooa Gallery component version 1.0.0 - 2.4.0 for Joomla
8.6
CVSS
0.3%
EPSS
No
On KEV
Description
A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BG
Balbooa Gallery component for Joomla · balbooa.com
1.0.0-2.4.0 · source: vendor
Affected product
BG
Balbooa Gallery component for Joomla
balbooa.com