CVE-2026-65946
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Joomla Extension - rolandd.com - contains XSS vectors in AJAX endpoint handlers in RO CSVI before version 9.11.0.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft, redirects, or data theft.
Recommendation
Update the RO CSVI extension to version 9.11.0 or later and apply proper input filtering in AJAX handlers.
Other vulnerabilities in RO CSVI
See all- CVE-2026-65944High
CSRF vulnerability in the Joomla extension RO CSVI versions prior to 9.11.0. CSRF vectors exist in AJAX endpoint handlers, potentially allowing an attacker to perform unauthorized actions in the context of an administrator's session.
- CVE-2026-65943High
Joomla extension RO CSVI (rolandd.com) before version 9.11.0 allows unauthenticated attackers to create directories on the server.
Original NVD description (English source)
Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0