Joomla! CMS EUVD-2026-31876

Q: What is the CVSS score of EUVD-2026-31876?

EUVD-2026-31876 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-25900 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-26 Joomla

GHSA-xvjh-fqcm-jpr6

XSS Joomla Cms

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:06 vuln.today

CVSS changed

May 26, 2026 - 17:22 NVD

6.9 (MEDIUM)

CVE Published

May 26, 2026 - 16:43 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Lack of output escaping leads to a XSS vector in the feed modules.

AnalysisAI

Stored cross-site scripting in Joomla! CMS feed modules allows a high-privileged authenticated attacker to inject unsanitized content that executes in the browser context of a victim user who passively views the affected feed output. Affecting the broad version spans of 3.0.0 through 5.4.5 and 6.0.0 through 6.1.0, the root cause is a failure to apply output escaping before rendering feed module data. No public exploit has been identified at time of analysis, and SSVC confirms no current active exploitation.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-controlled data is passed into HTML output without proper contextual encoding or escaping. Joomla!'s feed modules - which render RSS or Atom-style content feeds - fail to sanitize output prior to rendering, allowing injected markup to be interpreted as live HTML or JavaScript by the browser. The affected product is identified by CPE cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:*, spanning the Joomla! CMS application across two major version lines (3.x/5.x and 6.x). The CVSS 4.0 vector (PR:H) confirms that only a high-privileged principal - such as an administrator - can introduce the malicious payload, indicating a persistent (stored) XSS pattern rather than a simple reflected attack.

RemediationAI

Apply the vendor-released patch per the Joomla! Security Centre advisory at https://developer.joomla.org/security-centre/1033-20260501-core-xss-in-feed-modules.html. The advisory covers both the 5.x and 6.x lines; the patched release version is not independently confirmed from available input data, so administrators should consult the advisory for the exact target version (likely 5.4.6+ and 6.1.1+ based on the stated affected upper bounds, but this is inferred and not confirmed). As a compensating control where immediate patching is not possible, disable or restrict access to the affected feed modules in Joomla!'s Extension Manager - this eliminates the attack surface at the cost of feed functionality. Additionally, restrict administrative access to the Joomla! backend to trusted IP ranges or VPN, which reduces the PR:H attack surface by limiting who can inject a payload in the first place. Content Security Policy (CSP) headers can mitigate the impact of any residual XSS by blocking inline script execution, though this requires CSP configuration testing to avoid breaking legitimate site functionality.