CVE-2026-65882

MediumCVSS 6.1

Published: 28/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 28/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

In the Joomla extension Joomdle versions prior to 3.1.1, a Reflected XSS vulnerability was found. The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector.

Risk Assessment

An attacker can inject malicious JavaScript that executes in the victim's browser, leading to session theft, redirects, or data theft.

Recommendation

Update the Joomdle extension to version 3.1.1 or later. Additionally, apply input filtering for the goto url parameter.

Other vulnerabilities in Joomdle

CVE-2026-65881High
In the Joomla extension Joomdle versions prior to 3.1.1, the default configuration allows read access and password reset of CMS accounts. This is an insecure default configuration.

Original NVD description (English source)

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector.