CVE-2026-92231

Joomla Core's InputFilter can be bypassed for cross-site scripting because checkAttribute normalizes an attribute value and tests it against a javascript: scheme pattern without decoding HTML5 character entities first. A high-privileged user can store content that passes the filter and later executes script in the browser of another user who views it, with high confidentiality and integrity impact on the site and only low availability impact. The bug is CVE-2026-92231 (CWE-79), scored CVSS 4.0 7.1, and needs network access, high privileges, and passive user interaction. It affects Joomla 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3. No public proof-of-concept is known and it is not in the CISA KEV catalog, although the CVSS vector marks exploit maturity as proof-of-concept (E:P).

What to do: Move off the affected ranges by installing the official Joomla patched release for your branch (anything after 5.4.8 on the 5.x line, or after 6.1.3 on the 6.x line) from the 2026-09-15 core advisory. Until that is done, limit Super User and other high-privilege accounts and review stored content for attribute values that conceal a javascript: scheme with HTML5 entities.