Keyboard Shortcuts Extension EUVD-2026-47913

Exploitation requires: (1) the Keyboard Shortcuts extension for Joomla versions 1.0.0-3.2.5 installed and active on the target site; (2) the attacker must have sufficient Joomla role privileges to access and save the shortcut configuration interface - the provided CVSS PR:N rating is potentially inconsistent with a configuration-gated feature and should be verified with the vendor before relying on it for risk decisions; (3) a victim user must actively trigger the configured keyboard shortcut while browsing the site (UI:R). Limiting factors: the victim must interact with the shortcut rather than passively loading the page, which limits automated or mass exploitation (SSVC Automatable: no). Sites restricting shortcut configuration to super administrators effectively reduce the attacker population to fully-trusted accounts, making exploitation in those environments a low-residual-risk insider scenario rather than an external threat.

The provided CVSS score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N reflects network-reachable, low-complexity exploitation with Changed Scope and limited confidentiality and integrity impact. However, the PR:N (no privileges required) rating warrants scrutiny: the description specifically implicates the shortcut configuration interface, which in Joomla typically requires at minimum a contributor or manager role - PR:N may overstate attacker accessibility and should be verified with the vendor. EPSS at 0.21% (11th percentile) is very low, SSVC confirms exploitation status as 'none' with non-automatable attack characteristics and only partial technical impact. No KEV listing exists and no POC code is referenced in any available source. Real-world risk is moderate for multi-user Joomla sites where lower-privileged roles can access the shortcut configuration, and low for sites restricting that access to super administrators, making exploitation in those environments a low-residual-risk scenario.

An attacker with contributor-level or higher access to a Joomla site running the affected extension configures a keyboard shortcut with a malicious inline JavaScript payload - for example, a fetch call exfiltrating the current user's session cookie to an attacker-controlled server. When a higher-privileged user such as a site administrator triggers that shortcut while authenticated, the injected script executes in their browser, allowing the attacker to steal the admin session token and escalate privileges. No public exploit code is known at time of analysis, but the technique is a standard persistent XSS pattern requiring no special tooling.