XSS Vulnerability in Joomla! Modalreturn Layouts
CVE-2026-48951

5.9MEDIUM

Key Information:

Vendor

Joomla
Status
Joomla! Cms
Vendor
CVE Published:
7 July 2026

What is CVE-2026-48951?

A security flaw exists in the modalreturn layouts of various Joomla! components, stemming from a lack of proper escaping. This vulnerability allows attackers to execute malicious scripts in the context of a user's browser, potentially compromising user data and web application integrity.

Affected Version(s)

Joomla! CMS 4.0.0-5.4.6

Joomla! CMS 6.0.0-6.1.1

References

https://developer.joomla.org/security-centre/1059-2026070...
vendor-advisory

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jorian Woltjer
.