CVE-2026-58148 HIGH

CVE-2026-58148: Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla < 8.0.53

Vendor Chronoengine.com
Product ChronoForms extension for Joomla
Weakness CWE-79 · XSS
Published July 17, 2026
Last update July 17, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The Joomla extension ChronoForms is vulnerable to an unauthenticated stored XSS vulnerability.

Key dates

02Disclosure timeline

July 17, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2026-9148 Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field CVE-2026-57670 WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-57366 WordPress WPAdverts plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-57426 WordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerability CVE-2026-57672 WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability