XSS in Joomla! Project Cms
CVE-2026-21631
Lack of output escaping leads to a XSS vector in the multilingual associations component.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.000 (0.0th percentile) — read the EPSS interpretation.
Affected products
- Joomla! Project Cms — versions 4.0.0-5.4.3, 6.0.0-6.0.3
Weakness classification (CWE)
References
- developer.joomla.org/security-centre/1029-20260303-core-xss-vector-in-com-assoc… (vendor-advisory)
- github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-21631 (third-party-advisory)