XSS Vulnerability in Joomla Multilingual Associations Component
CVE-2026-21631

5.9MEDIUM

Key Information:

Vendor

Joomla
Status
Joomla! Cms
Vendor
CVE Published:
1 April 2026

What is CVE-2026-21631?

A security issue has been identified in Joomla's multilingual associations component, where insufficient output escaping can lead to a cross-site scripting (XSS) vulnerability. This allows attackers to inject malicious scripts into webpages viewed by other users, potentially compromising user sessions and sensitive data. Web administrators should ensure they apply the latest patches to mitigate this vulnerability.

Affected Version(s)

Joomla! CMS 4.0.0-5.4.3

Joomla! CMS 6.0.0-6.0.3

References

https://developer.joomla.org/security-centre/1029-2026030...
vendor-advisory
https://github.com/Shirshaw64p/security-advisories/tree/m...
third-party-advisory

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shirsendu Mondal & Md Tanzimul Alam Fahim, UNC Pembroke
.