CVE-2026-25901

joomla: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2026-25901)

mediumEPSS 0.2%

Affected

bitnami/joomla 3.0.0..*
bitnami/joomla 6.0.0..*

Description

Lack of output escaping leads to a XSS vector in the multilingual associations component.

Source: BSI WID Portal BSI CSAF OSV (Open Source Vulnerabilities)cvelistv5 NVD (NIST)ENISA EUVD CVE.org (MITRE)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

bitnamijoomla

3.0.06.0.0

Metrics

XIEM Effective CVSS

6.9

Source: nvd-v4

EPSS percentile

14.4 %

Elevated — this CVE ranks above at least 10% of all CVEs scored today.

—

Show all metrics

Severity

medium

55.18

Exploit maturity

no public PoC known

6.1

6.9

0.2 %

Low — model estimates < 1% exploitation likelihood.

Published

2026-05-28 08:45 UTC

CWE-79

Weakness classes (CWE)

CWE-79Base
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
cwe.mitre.org →

References & sources