Joomla! CMS EUVD-2026-31876

Exploitation requires an attacker to already hold a high-privileged account on the Joomla! CMS instance, confirmed by CVSS PR:H. Additionally, passive user interaction by a victim (CVSS UI:P) is required to trigger the XSS payload - the victim must load a page or view that renders the affected feed module output. The feed modules component must be active and accessible within the Joomla! installation. Limiting factors include: the high-privilege prerequisite substantially restricts the attacker pool to compromised admin/editor accounts; the victim must visit the affected feed-rendered page; and the attack is not automatable (SSVC: Automatable: no). Exploitation is therefore limited to scenarios where an attacker has already achieved privileged backend access and can target a specific authenticated or unauthenticated visitor loading a feed-rendered page.

The CVSS 4.0 base score of 6.9 reflects a meaningful but constrained threat. Decomposing the vector: AV:N/AC:L/AT:N establish that exploitation is network-reachable with low complexity and no special attack requirements once the payload is in place, but PR:H sharply limits who can inject it - only high-privileged accounts. UI:P confirms a victim must passively load the affected feed page. The confidentiality impact on the vulnerable component is rated High (VC:H), consistent with credential or session token theft via XSS, while integrity and availability impacts are Low. Scope is contained (SC:N/SI:N/SA:N), meaning no lateral impact to other systems. EPSS at 0.04% (13th percentile) corroborates a very low probability of exploitation in the wild. SSVC reinforces this: Exploitation status is 'none', the attack is not automatable, and technical impact is only 'partial'. The high privilege prerequisite is the dominant risk-reducing factor - an attacker who already holds admin-level access to a Joomla! instance has many more direct paths to impact, making this XSS a secondary concern. No conflict between signals is identified; all available data consistently points to a low-priority real-world risk despite the CMS's wide install base.

An attacker holding a high-privileged Joomla! CMS account (e.g., an administrator or editor with backend access) navigates to a feed module configuration and injects a malicious JavaScript payload into a field that is rendered without output escaping. When a lower-privileged user or site visitor subsequently loads a page that triggers the feed module output, the injected script executes in their browser context, enabling session cookie theft or credential harvesting. No public proof-of-concept exploit code has been identified at time of analysis.