[20260908] - Core - XSS in HTML Mail Templates
Joomla patched moderate XSS CVE-2026-90918 in HTML mail templates for CMS 4.x, 5.x, and 6.x.
Joomla patched CVE-2026-90918, a moderate cross-site scripting flaw in the HTML mail template feature. The feature lacks an escaping mechanism, creating XSS vectors in multiple extensions. It affects Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3, with moderate exploit probability. The fix is in versions 5.4.9 and 6.1.4. Joe Grey reported it on 2026-08-24; it was fixed on 2026-09-25. Exploitation is not described as observed.
- CVE-2026-90918 is moderate XSS in HTML mail templates.
- Missing escaping creates XSS vectors in multiple extensions.
- Affects CMS 4.0.0–5.4.8 and 6.0.0–6.1.3; probability moderate.
- Upgrade to Joomla 5.4.9 or 6.1.4.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90918 | XSS in Joomla HTML Mail Templates | 6.9 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Moderate Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.