[20260911] - Core - XSS in link toolbar layout
Joomla fixed moderate XSS CVE-2026-92224 in the link toolbar layout, reported by Google and Ada Logics.
Joomla disclosed CVE-2026-92224, a moderate XSS vulnerability in the core link toolbar layout caused by inputs that were not properly escaped. Impact and severity are moderate and exploit probability is low. Affected versions are Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3, fixed in 5.4.9 and 6.1.4. Google and Ada Logics reported it on 2026-09-10; the fix shipped on 2026-09-25. No active exploitation is mentioned.
- CVE-2026-92224 is moderate XSS in the link toolbar layout.
- Unescaped inputs create the XSS vector; probability is low.
- Affects Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3.
- Reported by Google and Ada Logics; fixed in 5.4.9 and 6.1.4.
- CVEs
- CVE-2026-92224
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- GoogleAda Logics
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92224 | XSS in Joomla! core link toolbar layout | 5.9 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.