Joomla! CMS CVE-2026-30894

Exploitation requires the attacker to hold a high-privilege Joomla backend account (PR:H per CVSS 4.0 vector) capable of creating or modifying content items that are tracked by the content history component (com_contenthistory must be enabled, which is a default Joomla feature). A second prerequisite is that another privileged backend user must passively view the content history entry where the payload is stored (UI:P - passive interaction, such as navigating to the history view). Exploitation is limited to the Joomla administrative backend; it is not reachable from the public-facing frontend. The attack is further bounded by the requirement for an existing high-privilege account, ruling out unauthenticated external attackers. Sites running Joomla! CMS versions 3.0.0-5.4.5 or 6.0.0-6.1.0 with multiple backend users are the realistic risk population.

The CVSS 4.0 base score of 6.9 reflects a meaningful but access-constrained risk. The vector requires High Privileges (PR:H), meaning only users with administrator-level or equivalent Joomla backend access can inject malicious payloads - this significantly limits the attacker population and rules out opportunistic unauthenticated exploitation. The Vulnerable System Confidentiality Impact is rated High (VC:H), which for a stored XSS in an admin panel translates to realistic session hijacking or credential theft against other privileged backend users. Subsequent System impacts are all None (SC:N/SI:N/SA:N), bounding the blast radius to the Joomla application layer. EPSS at 0.04% (13th percentile) is consistent with a high-privilege, interaction-dependent vulnerability unlikely to be mass-exploited. No KEV listing and no confirmed POC further support a lower urgency classification. The primary real-world risk is insider threat or a compromised high-privilege account being used to escalate access laterally to other administrator sessions - a meaningful risk in multi-admin Joomla deployments. CVSS and EPSS signals are internally consistent and do not conflict.

An attacker who already holds a high-privilege Joomla backend account (editor, administrator, or equivalent) creates or modifies a content item, embedding a JavaScript payload in a field that is stored without escaping in the content history log. When another authenticated backend user - such as a site super-administrator - navigates to the content history view for that item, the payload executes in their browser session, potentially exfiltrating their session cookie or performing actions on their behalf. No public POC has been identified at time of analysis, but the attack pattern is straightforward for any attacker with existing backend access.