CVE-2026-92231

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 1.5.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3

Description An XSS filter bypass exists in the InputFilter due to an HTML5 entity decode mismatch. The checkAttribute() function normalized attribute values before testing them against the "javascript:" scheme regex without first decoding HTML5 entities, which creates a vector for Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.