Joomla! CMS CVE-2026-30895

Exploitation requires the attacker to hold a high-privileged Joomla! CMS account capable of creating or editing com_content articles with readmore link fields (PR:H per CVSS vector). A victim user must then actively interact with the affected readmore link (UI:P per CVSS vector) - passive page load alone is insufficient to trigger the payload under typical XSS-in-link scenarios. The vulnerability is present only in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0. Sites running patched versions or those where content editor roles are restricted to fully trusted accounts are not at material risk from external attackers. Limiting factors: high privilege prerequisite, required user interaction, and absence of any automation vector (SSVC Automatable: no).

The composite risk profile places this as a low-to-medium operational priority. CVSS 4.0 scores 6.9, but the PR:H (High Privileges Required) and UI:P (User Interaction Required) modifiers significantly constrain exploitability - an attacker must first hold a high-privileged Joomla! account (e.g., administrator or content editor role) before introducing the malicious payload. EPSS sits at 0.04% (13th percentile), indicating near-negligible exploitation probability relative to the broader CVE population. SSVC corroborates this: Exploitation is rated 'none', Automatable is 'no', and Technical Impact is 'partial'. The vulnerability is not listed in the CISA KEV catalog, and no POC has been identified at time of analysis. The VC:H (High Confidentiality impact on vulnerable system) in the CVSS vector reflects that successful XSS can harvest session tokens, but this outcome depends entirely on a high-privileged insider or compromised admin account acting maliciously. There is no contradiction between the CVSS vector and the description. Overall: a real but narrow-impact vulnerability whose exploitability is gated by the PR:H and UI:P preconditions.

An attacker with a high-privileged Joomla! CMS account (administrator or editor) crafts an article whose readmore link contains an unescaped JavaScript payload (e.g., a javascript: URI or an injected event handler attribute). When a site visitor browses the article listing and clicks the readmore link, the injected script executes in the visitor's browser, potentially harvesting their session cookie or performing actions on their behalf. No public exploit code has been identified at time of analysis, and the PR:H requirement means opportunistic mass exploitation is not a realistic threat vector.