CVE-2026-92224 MEDIUM

CVE-2026-92224: Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-79 · XSS
Published September 29, 2026
Last update September 30, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector.

Key dates

02Disclosure timeline

September 29, 2026 CVE published
September 30, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes CVE-2026-76053 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser CVE-2026-64851 Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers CVE-2026-77365 Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter CVE-2026-18328 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter