CVE-2026-92225

Joomla! core fails to escape user-supplied values in the module list layout, creating a cross-site scripting (CWE-79) flaw. An attacker who already has high-privilege backend access can place those values so that script runs in the browser of an administrator who views the module list (network-reachable, low complexity, passive user interaction). On the vulnerable site that can expose or alter high-value data and admin actions, with only limited availability impact and no follow-on impact scored for other systems. Sites running Joomla 4.0.0 through 5.4.8 or 6.0.0 through 6.1.3 are affected. CVSS 4.0 is 5.9 (medium) with exploit maturity unreported; it is not on the CISA KEV list and no public proof-of-concept is known.

What to do: Upgrade Joomla! core to a release outside the affected ranges (newer than 5.4.8 on the 4.x/5.x line, or newer than 6.1.3 on the 6.x line) from the official 12 September 2026 security update. Until that is applied, limit backend accounts to trusted administrators and review module records for unexpected markup in fields shown on the module list. No public exploit is known; prioritize admin-session protection because a successful attack runs in a privileged user's browser.