CVE-2026-48950 MEDIUM

CVE-2026-48950: Joomla! Core - [20260704] - XSS in com_templates

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-79 · XSS
Published July 7, 2026
Last update July 8, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 4.0.0 through 5.4.6 contain a cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts. An attacker with high-level admin privileges can craft input that executes in other users' browsers when they view affected pages. This requires the victim to interact with the malicious content.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that execute in other users' browsers when they view affected pages.

Potential impact on your site

04Site Impact

A compromised admin account can inject scripts affecting other admins or users, potentially stealing sessions or credentials.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrator privileges and the victim must view the page containing the injected script.

Key dates

06Disclosure timeline

July 7, 2026 CVE published
July 8, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-69154 WordPress SpaLab | Beauty Salon WordPress Theme theme <= 6.7 - Cross Site Scripting (XSS) vulnerability CVE-2026-57350 WordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-57674 WordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerability CVE-2026-57426 WordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerability CVE-2026-57356 WordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerability