CVE-2026-90914
Received Received - Intake

XSS in Joomla Core Media Output Layouts

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Joomla! Project

Description
Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-90914
EUVD
EUVD-2026-89083

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
joomla joomla From 4.0.0 (inc) to 5.4.9 (exc)
joomla joomla From 6.0.0 (inc) to 6.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90914 is a Cross-Site Scripting (XSS) vulnerability in Joomla! CMS versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. It occurs due to insufficient escaping in generic audio and video output layouts, enabling malicious scripts to run in user browsers.

Detection Guidance

To detect this vulnerability, check your Joomla version against affected ranges (4.0.0-5.4.8, 6.0.0-6.1.3). Use commands like 'composer show joomla/joomla' or check the Joomla admin panel under System > System Information. If vulnerable, update to versions 5.4.9 or 6.1.4.

Inspect media output layouts for improper escaping in audio/video templates. Look for user-controlled input in rendered HTML output.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into web pages viewed by users. This could lead to theft of session cookies, account takeover, or unauthorized actions on behalf of users. It primarily affects users interacting with vulnerable Joomla sites.

Compliance Impact

XSS vulnerabilities can lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance penalties if user data is compromised due to this flaw.

Mitigation Strategies

Immediately upgrade Joomla to versions 5.4.9 or 6.1.4 or later. If upgrading is not possible, apply patches from the Joomla Security Centre or disable media output layouts until patched.

Review and restrict user permissions to reduce attack surface. Monitor for unusual script execution in browser consoles or server logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90914. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart