What is the CVSS score of CVE-2026-65882?

CVE-2026-65882 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Joomdle CVE-2026-65882

EUVD-2026-49788 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-28 security@joomla.org

GHSA-f46h-cmh6-3vf3

XSS

6.1

CVSS 3.1 · Vendor: joomla

Severity by source

Vendor (joomla) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (joomla) · only source for this CVE.

CVSS VectorVendor: joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 20:30 vuln.today

CVE Published

Jul 28, 2026 - 13:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector.

AnalysisAI

Reflected cross-site scripting (XSS) in the Joomdle Joomla extension before version 3.1.1 allows remote attackers to inject arbitrary web scripts via the 'goto' URL parameter of the Moodle wrapper endpoint. When a victim clicks a crafted link, the attacker can execute script in the victim's browser, potentially stealing session cookies or performing actions on behalf of the user. The vulnerability requires user interaction and has no publicly known exploit code or active exploitation at this time.