Vulnerabilitymedium
[20260904] - Core - XSS in the generic media output layouts
AI summary · grok-4.7Summaries by Vani AI
Joomla patched moderate XSS CVE-2026-90914 in generic audio and video media layouts.
Joomla patched CVE-2026-90914, a cross-site scripting flaw in the CMS generic media output layouts. Lack of escaping in the generic audio and video layouts can lead to XSS. The bug affects versions 4.0.0–5.4.8 and 6.0.0–6.1.3 and is fixed in 5.4.9 and 6.1.4. Joomla rates impact and severity moderate and probability low, with no exploitation reported.
Key facts
- Missing output escaping in generic audio and video layouts.
- Results in cross-site scripting in media output.
- Affects Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3.
- Moderate severity and impact; fixed in 5.4.9 and 6.1.4.
- CVEs
- CVE-2026-90914
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla Security Strike Team
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90914 | XSS in Joomla core audio and video media layouts | 5.9 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.