# CVE-2026-25900: Joomla! CMS cross-site scripting in feed modules

Source: https://junglewise.ai/threats/cve-2026-25900-joomla-cms-cross-site-scripting-in-feed-modules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-25900 · Severity: info · CVSS 6.9 · Published 2026-05-26

A vulnerability exists in the Joomla! CMS feed modules, which are used to display external content feeds on a website. An attacker with high-level administrative privileges could inject malicious scripts that execute in the browsers of other users. This could lead to unauthorized actions being performed on behalf of those users or the theft of sensitive session information.

## Quick answers

**Is CVE-2026-25900 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25900 being exploited in the wild.

**How severe is CVE-2026-25900?** Informational severity, with a CVSS score of 6.9, published 26 May 2026.

**Which products and versions are affected?** Joomla! Project Joomla! CMS 3.0.0-5.4.5, 6.0.0-6.1.0.

**Is there a fix for CVE-2026-25900?** A patch was published on 2026-05-26: Fixed versions 5.4.6 and 6.1.1 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25900 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-25900?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Joomla! CMS versions 3.0.0 through 5.4.5 and 6.0.0 through 6.1.0. The flaw is caused by insufficient output escaping within the feed modules. An attacker with high privileges (PR:H) can exploit this by injecting malicious payloads into feed configurations, which are then executed when a user views the affected page. This can result in the execution of arbitrary JavaScript in the context of the victim's session. The issue is addressed in Joomla! CMS versions 5.4.6 and 6.1.1.

## Affected products

- Joomla! Project Joomla! CMS 3.0.0-5.4.5, 6.0.0-6.1.0

## Timeline

- 2026-03-28: disclosed: Vulnerability reported to the Joomla! Security Centre.
- 2026-05-26: patched: Fixed versions 5.4.6 and 6.1.1 released.
- 2026-05-26: advisory: Official security announcement published.

## References

- [https://developer.joomla.org/security-centre/1033-20260501-core-xss-in-feed-modules.html](https://developer.joomla.org/security-centre/1033-20260501-core-xss-in-feed-modules.html)