EUVD-2026-47806
Cross-site Scripting (XSS) (CWE-79)
2026-07-22
Joomla
4.8
CVSS 3.1 · Vendor: Joomla
Share
Severity by source
Vendor (Joomla)
PRIMARY
4.8
MEDIUM
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Lifecycle Timeline
3
Analysis Generated
Jul 27, 2026 - 14:24 vuln.today
CVSS changed
Jul 27, 2026 - 14:22 NVD
4.8 (MEDIUM)
CVE Published
Jul 22, 2026 - 20:40 cve.org
UNKNOWN (no severity yet)
DescriptionCVE.org
Stored condition values could also execute HTML/JavaScript in administrator summaries.
AnalysisAI
Stored cross-site scripting in Regular Labs Conditional Content and related Joomla extensions enables authenticated administrators to execute
CVE-2026-63280
HIGH
8.8
Jul 22
We are tasked with generating a JSON analysis for CVE-2026-63280. We have the description, CVSS, CWE, EPSS, SSVC, tags,
CVE-2026-63265
HIGH
8.0
Jul 22
Broken CSRF token enforcement across 23 Regular Labs AJAX-based Joomla extensions allows authenticated lower-privileged
CVE-2026-63683
HIGH
7.5
Jul 22
Authentication bypass in Regular Labs Joomla extensions (Advanced Module Manager, Conditional Content, Content Templater
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).