Joomla CMS EUVD-2026-89075

Requires an authenticated Joomla backend user with sufficient privileges to supply/store values rendered by the module list layout (PR:H), and passive interaction from a victim who views that module list (UI:P). It affects Joomla Core 4.0.0-5.4.8 and 6.0.0-6.1.3. Limiting factors: exploitation is confined to the administrative backend and needs an existing privileged account, so it cannot be triggered by anonymous internet users against a default front-end; the payload only fires when another user renders the unescaped module-list layout.

This is a moderate-priority, not a top-tier, issue. The CVSS 4.0 base score is 5.9 (medium) with vector AV:N/AC:L/AT:N/PR:H/UI:P - network reachable and low complexity, but gated by PR:H (high privileges) meaning the attacker already needs an authenticated Joomla backend/administrator account with access to the module manager, plus passive user interaction (UI:P) from a victim viewing the affected module-list layout. The E:U (Exploit: Unproven) temporal signal, the absence of any EPSS score, no CISA KEV listing, and no public POC all point to no known exploitation and no imminent widespread-exploit pressure. There is a tension worth flagging: the vendor's 4.0 vector rates VC:H/VI:H (high confidentiality and integrity impact) for what the description characterizes as a single XSS vector in an admin layout - for a stored/reflected XSS the concrete impact is typically limited (session/token theft, admin-context script execution), so those H ratings look aggressive and should be verified against the Joomla advisory. Net: a real bug worth patching, but its PR:H prerequisite and admin-only surface make it far lower real-world risk than an unauthenticated Joomla flaw.

An attacker who already holds a privileged Joomla backend account (or a lower-privileged user granted module-management rights) stores a crafted value that is rendered unescaped in the module list layout. When another administrator subsequently opens the module list, the injected script executes in their authenticated backend session, enabling session/token theft or actions in the victim admin's context. No public exploit code has been identified at time of analysis.