CVE-2026-90918
MediumCVSS 6.9Summary
Joomla! Core's mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
Risk Assessment
An attacker can inject malicious JavaScript that executes in a user's browser, potentially leading to session or data theft. This may affect multiple extensions using mail templates.
Recommendation
Update Joomla! to a version containing the fix (outside 4.0.0-5.4.8 and 6.0.0-6.1.3). Review mail templates for unusual content.
Other vulnerabilities in Joomla! Core
See all- CVE-2026-92223Medium
Joomla! Core has improper ACL checks for workflow stage changes. Unauthorized users can update the workflow stage of inaccessible contents. Affects versions 5.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90917Medium
Joomla! Core has improper ACL checks in outputs for tagged items. Unauthorized users can view content items from inaccessible categories. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90916Medium
Joomla! Core has improper ACL checks in the content history comparison view. Unauthorized users can view inaccessible contents. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90914Medium
Joomla! Core lacks escaping in the generic media output layouts, leading to an XSS vulnerability. Affects the generic audio and video output layouts. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90907Medium
Joomla! Core's profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.
- CVE-2026-90906Medium
Joomla! Core lacks escaping in the HTMLHelper::link method, leading to XSS vulnerabilities. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.
Original NVD description (English source)
Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS