CVE-2025-54476 MEDIUM

CVE-2025-54476: Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-79 · XSS
Published September 30, 2025
Last update October 1, 2025
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 3.10.20 and earlier contain a cross-site scripting (XSS) vulnerability. An authenticated administrator with high privileges can inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction to trigger. This allows attackers to steal session tokens, modify site content, or perform actions on behalf of victims.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that run in other users' browsers when they visit affected pages.

Potential impact on your site

04Site Impact

Administrators with high privileges can be tricked into executing malicious scripts that compromise other user accounts or site functionality.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrator privileges and the victim must click a link or visit a page containing the payload.

Key dates

06Disclosure timeline

September 30, 2025 CVE published
October 1, 2025 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57360 WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-57763 WordPress Structured Content plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-57359 WordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability CVE-2026-57686 WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability CVE-2026-57362 WordPress ChatBot plugin <= 8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability