[20260912] - Core - XSS in module list
AI summary · grok-4.7Summaries by Vani AI
Unescaped module-list values in Joomla CMS enable XSS; fixed in versions 5.4.9 and 6.1.4.
Joomla fixed CVE-2026-92225, a cross-site scripting issue in the module list layout caused by failing to escape user-supplied values. It affects Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3. Impact and severity are moderate and probability is low. Administrators should upgrade to 5.4.9 or 6.1.4. No active exploitation is described.
Key facts
- CVE-2026-92225 is stored-style XSS from unsanitized module-list values.
- Joomla rates impact and severity moderate and probability low.
- Affects CMS 4.0.0–5.4.8 and 6.0.0–6.1.3.
- Fixed in 5.4.9 and 6.1.4; reported by Google and Ada Logics.
- CVEs
- CVE-2026-92225
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- GoogleAda Logics
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92225 | XSS in Joomla! core module list (4.0.0–5.4.8, 6.0.0–6.1.3) | 5.9 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.