[20260806] - Core - XSS through schema.org outputs
Joomla fixed CVE-2026-73336, an XSS in schema.org markup outputs caused by improper escaping, affecting CMS 5.1.0-5.4.7 and 6.0.0-6.1.2.
Joomla security advisory 20260806 describes CVE-2026-73336, a cross-site scripting issue in schema.org markup outputs. Improper escaping flags create an XSS vector in schema.org output; the vendor rates impact and severity as moderate with low probability. Affected versions are 5.1.0-5.4.7 and 6.0.0-6.1.2; fixes ship in 5.4.8 and 6.1.3. The issue was reported by Amin Isayev and Geo (GitHub.com/geo-chen) on 2026-07-21.
- Improper escaping flags enable XSS in schema.org markup outputs
- Affects Joomla CMS 5.1.0-5.4.7 and 6.0.0-6.1.2
- Fixed in Joomla 5.4.8 and 6.1.3
- CVEs
- CVE-2026-73336
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73336 | Stored XSS via schema.org markup output in Joomla! core 5.1.0–5.4.7 and 6.0.0–6.1.2 | 5.1 | <1% |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 5. 1.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.