[20260908] - Core - XSS in HTML Mail Templates
Joomla patched moderate XSS CVE-2026-90918 in HTML mail templates for CMS 4.x, 5.x, and 6.x.
42
Vulnerability1 · 1 read
CVE-2026-90918
XSS in Joomla HTML Mail Templates
- CVSS 4.0
- 6.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Joomla core does not escape content in its HTML mail template feature, which creates cross-site scripting (CWE-79) vectors that can appear in multiple extensions. The issue affects Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. The vendor rates it medium (CVSS 4.0 6.9) as network-reachable without privileges or user interaction, with a low confidentiality impact and no integrity or availability impact. Sites still on those releases are affected. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade Joomla to a release outside the stated vulnerable ranges (later than 5.4.8 on the 4.x/5.x line and later than 6.1.3 on the 6.x line) using the vendor security update. Until then, review HTML mail templates and extensions that render them for unsanitized content, and limit who can edit those templates.
| Product | Affected |
|---|---|
| Joomla! Core | 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 |
Estimated exposure
masson the order of 100,000 to 1,000,000+ Joomla sites — Public CMS market surveys have long placed Joomla in the hundreds of thousands to low millions of sites, and the listed ranges cover supported 4.x, 5.x through 5.4.8, and early 6.x, so a large share of current installs are plausibly…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
- Vendors
- joomla
- Products
- joomla\!
- Ecosystems
- Joomla
- Weakness
- CWE-79
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X