Which versions of ChronoForms are affected by CVE-2026-58148?

A stored cross-site scripting vulnerability in the ChronoForms extension for Joomla (CVE-2026-58148, CVSS 8.7) allows unauthenticated attackers to inject persistent malicious JavaScript that executes…

How to fix or mitigate CVE-2026-58148?

Within 24 hours, inventory all Joomla instances in use and confirm whether ChronoForms is deployed; identify the current extension version and number of users impacted. Within 7 days, disable the ChronoForms extension if operationally feasible, or implement emergency compensating controls including strict input validation on all form fields, Web Application Firewall rules to block script injection patterns, and Content Security Policy headers to prevent inline script execution. Within 30 days, establish daily monitoring of the vendor advisory and CISA alerts for patch availability; prepare rollback and re-enablement procedures that will be triggered immediately upon vendor patch release, testing the patch in a staging environment before production deployment.

ChronoForms CVE-2026-58148

Q: What is the CVSS score of CVE-2026-58148?

CVE-2026-58148 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45185 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-17 Joomla

GHSA-2r72-6w83-g3hq

XSS Chronoforms Extension For Joomla

8.7

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Unauthenticated network stored XSS (PR:N, AV:N) needs a victim to view content (UI:R) and crosses into their browser (S:C); XSS impact is partial confidentiality/integrity (C:L/I:L), not the VC:H/VI:H/VA:H the input claims.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 16:17 vuln.today

CVE Published

Jul 17, 2026 - 15:48 cve.org

HIGH 8.7

DescriptionCVE.org

The Joomla extension ChronoForms is vulnerable to an unauthenticated stored XSS vulnerability.

AnalysisAI

Stored cross-site scripting in the ChronoForms extension for Joomla lets unauthenticated attackers persist malicious JavaScript that executes in the browser of anyone who later views the affected page. The flaw carries a CVSS 4.0 base score of 8.7 and requires no authentication (PR:N), though a victim must load the poisoned content (UI:P). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

ChronoForms is a widely used form-builder extension for the Joomla CMS, allowing site operators to create data-collection and submission workflows. The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS: attacker-supplied input - most plausibly submitted through a ChronoForms form field - is persisted server-side and later rendered back into an HTML context (for example, a form-submission review, confirmation view, or administrator listing) without adequate output encoding. The single CPE, cpe:2.3:a:chronoengine.com:chronoforms_extension_for_joomla:*:*:*:*:*:*:*:*, identifies the affected component as ChronoEngine's ChronoForms extension across all listed versions, with no upper version bound supplied in the data.

RemediationAI

No vendor-released patch identified at time of analysis and no exact fix version is present in the input data, so administrators should monitor the ChronoEngine vendor site (https://www.chronoengine.com/) and the Joomla Vulnerable Extensions List for a patched release and upgrade as soon as one is published. As compensating controls until a fix lands: place the Joomla site behind a web application firewall with XSS filtering to strip script payloads from form submissions (trade-off: rule tuning may block legitimate rich input); disable or unpublish any public-facing ChronoForms forms that are not business-critical (trade-off: loss of that form's functionality); enforce a restrictive Content-Security-Policy that blocks inline script execution (trade-off: may break legitimate inline scripts and requires testing); and restrict access to ChronoForms administrator/review views to trusted networks to limit who can trigger stored payload rendering. Do not treat absence of a listed patch as confirmation none exists - verify directly with the vendor.