Joomla! CMS CVE-2026-30894

Q: What is the CVSS score of CVE-2026-30894?

CVE-2026-30894 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31872 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-26 Joomla

GHSA-g57j-96qr-jr34

XSS Joomla Cms Joomla Project

6.9

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Joomla) · only source for this CVE.

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:07 vuln.today

CVSS changed

May 26, 2026 - 17:22 NVD

6.9 (MEDIUM)

CVE Published

May 26, 2026 - 16:42 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Lack of output escaping leads to a XSS vector in the content history component.

AnalysisAI

Cross-site scripting in Joomla! CMS content history component (com_contenthistory) allows a high-privileged attacker to inject persistent malicious scripts due to missing output escaping, leading to confidentiality compromise of the vulnerable system when a victim views affected history entries. Confirmed affected versions span Joomla! CMS 3.0.0-5.4.5 and 6.0.0-6.1.0 across an exceptionally wide installed base. No public exploit code exists and the vulnerability is not in the CISA KEV catalog; EPSS of 0.04% (13th percentile) confirms no observed widespread exploitation at time of analysis.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to apply context-aware HTML output escaping within the content history component of Joomla! CMS (CPE: cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:*). Joomla's com_contenthistory component tracks revision history for content items; user-controlled data stored in history records is rendered back into the administrative interface without sanitization, creating a stored XSS sink. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) indicates the vulnerability is network-reachable, requires no additional technical prerequisites beyond credentials, and only requires passive user interaction - consistent with a stored XSS pattern where payload execution occurs when a victim loads an affected page rather than clicking an explicit link.

RemediationAI

The primary remediation is to upgrade to a patched release per the Joomla Security Centre advisory at https://developer.joomla.org/security-centre/1035-20260503-core-xss-in-com-contenthistory. An exact fixed version number is not independently confirmed from the available data - consult the advisory directly to identify the minimum safe release for your branch (5.x or 6.x). As a compensating control for environments that cannot immediately patch, administrators can restrict access to the content history feature by limiting backend access to only trusted, essential accounts and reviewing user role assignments to minimize the number of accounts capable of creating or editing versioned content. Disabling or restricting com_contenthistory via Joomla's plugin/component manager reduces exposure but may impact editorial workflow. Monitor backend session activity for anomalous behavior from high-privilege accounts as an interim detective control.