CVE-2026-92225
MediumCVSS 5.9Summary
Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector.
Risk Assessment
An attacker could inject malicious script that executes in the victim's browser, potentially leading to session theft or other actions in the user's context.
Recommendation
Update Joomla to a patched version (above 5.4.8 or 6.1.3) or apply available security patches.
Other vulnerabilities in Joomla
See all- CVE-2026-92232High
Joomla! Core versions 1.5.0-5.4.8 and 6.0.0-6.1.3 have an XSS filter bypass in InputFilter. The cleanAttribute method removes HTML data URIs, but injected whitespace characters can circumvent that cleanup, causing an XSS vector.
- CVE-2026-92231High
Joomla! Core versions 1.5.0-5.4.8 and 6.0.0-6.1.3 have an XSS filter bypass in InputFilter due to an HTML5 entity decode mismatch. The checkAttribute method normalizes an attribute value before testing it against the "javascript:" scheme regex, but without decoding HTML5 entities beforehand, causing an XSS vector.
- CVE-2026-92227High
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have an MFA authentication bypass vulnerability due to premature issuance of a rememberme cookie. This allows bypassing the multi-factor authentication requirement.
- CVE-2026-92226High
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have improper ACL checks for various webservice edit tasks. An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items.
- CVE-2026-92224Medium
Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector.
- CVE-2026-92222High
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have SSRF vectors in various core extensions. URLs used for serverside requests were improperly validated, leading to SSRF vectors.
- CVE-2026-90915High
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have an arbitrary directory deletion vulnerability via the cache purge action. An improper validation of the cache group name allowed path traversals in the file storage of the caching layer, resulting in arbitrary directory deletions.
- CVE-2026-90913High
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have improper ACL checks for access level webservice endpoints. An improper access check allows unauthorized users to perform mutation actions in access level endpoints.
- CVE-2016-8870High
The register method in the UsersModelRegistration class in Joomla! before version 3.6.4, when registration has been disabled, allows remote attackers to create user accounts due to failure to check the 'Allow User Registration' configuration setting.
- CVE-2015-8769High
SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.
Original NVD description (English source)
Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS