CVE-2026-30895
XSS in Joomla com_content Readmore Links
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: Joomla! Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| joomla | cms | From 4.0.0 (inc) to 5.4.5 (inc) |
| joomla | cms | From 6.0.0 (inc) to 6.1.0 (inc) |
| joomla | cms | 5.4.6 |
| joomla | cms | 6.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-30895 is a Cross-Site Scripting (XSS) vulnerability in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0.
The vulnerability occurs due to insufficient output escaping in the content history component, specifically in the readmore links, which allows attackers to inject and execute malicious scripts.
This means that when a user interacts with these readmore links, malicious code could run in their browser, potentially compromising their session or data.
How can this vulnerability impact me? :
This XSS vulnerability can allow attackers to execute malicious scripts in the context of a user's browser session.
- Steal sensitive information such as cookies or session tokens.
- Perform actions on behalf of the user without their consent.
- Potentially redirect users to malicious websites or display fraudulent content.
Overall, it can lead to compromised user accounts, data breaches, and loss of trust in the affected Joomla! CMS site.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-30895 vulnerability, you should upgrade your Joomla! CMS to version 5.4.6 or 6.1.1 or later, where the issue has been fixed.
This vulnerability is caused by insufficient output escaping in the content history component, which allows Cross-Site Scripting (XSS) attacks.
Additionally, you can contact the Joomla! Security Strike Team (JSST) at the Joomla! Security Centre for further assistance.