Alex Joseph
A significant security flaw has been identified in Joomla!, a popular content management system. This vulnerability, tracked as CVE-2026-92225, affects the core of the Joomla! platform, specifically within its module list feature. It’s rated with a Medium severity, indicating a notable risk to affected websites.
At its heart, this is a Cross-Site Scripting (XSS) vulnerability. In simple terms, this means that the module list in Joomla! did not properly check or “escape” certain user-provided information. When a website doesn’t properly handle user input, a malicious actor could potentially insert harmful code, such as JavaScript, into a web page. If this malicious code is then viewed by another user, it can execute in their browser. This could lead to various unwelcome outcomes, including unauthorized access to user accounts, session hijacking, or defacing website content. The vulnerability was responsibly reported by Google and Ada Logics.
CVE Details
Product Name: Joomla!
Published: September 29, 2026
Severity: Medium
Status: Analyzed
Affected Products
This XSS vulnerability impacts specific versions of the Joomla! CMS. If your website is running any of the following versions, it is vulnerable:
- Joomla! CMS versions 4.0.0 through 5.4.8
- Joomla! CMS versions 6.0.0 through 6.1.3
Current Status
The vulnerability, CVE-2026-92225, has been thoroughly analyzed by the Joomla! Security Strike Team. Crucially, a fix has been released, meaning that website administrators can take action to protect their installations. The issue was reported on September 10, 2026, and a fix was made available by September 25, 2026.
Severity Level
The vulnerability is categorized as Medium severity, with a CVSS score of 6.7. A medium severity rating means that while the vulnerability could be exploited, it might require specific conditions or some level of user interaction. However, the potential impact of an XSS attack is still significant, ranging from defacement to unauthorized data access. It’s important not to underestimate even “medium” risks, as they can still be stepping stones for more complex attacks.
Possible Solutions
The good news is that Joomla! has released patches to address this XSS vulnerability. The recommended solution is to upgrade your Joomla! installation immediately to a patched version. Specifically, you should upgrade to:
- Version 5.4.9
- Version 6.1.4
Regularly updating your CMS is a fundamental security practice. Always back up your website before performing any updates to ensure a smooth process and data safety.
References
https://developer.joomla.org/security-centre/1092-20260912-core-xss-in-module-list.html
https://www.joomla.org/
