Cross-Site Scripting Vulnerability in Joomla! Core Affecting Multiple Versions
CVE-2026-92225

5.9MEDIUM

Key Information:

Vendor

Joomla
Status
Joomla! Cms
Vendor
CVE Published:
29 September 2026

What is CVE-2026-92225?

A vulnerability affecting Joomla! Core allows for cross-site scripting (XSS) due to inadequate escaping of user-supplied values in the module list layout. This flaw can be exploited by attackers to inject malicious scripts into web pages viewed by users, potentially compromising user data and sessions. Organizations using affected versions of Joomla should prioritize applying security updates to mitigate this risk.

Affected Version(s)

Joomla! CMS 4.0.0-5.4.8

Joomla! CMS 6.0.0-6.1.3

References

https://www.joomla.org/
product
https://developer.joomla.org/security-centre/1092-2026091...
vendor-advisory

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Google and Ada Logics
.