Is CVE-2026-30894 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30894 being exploited in the wild.

How severe is CVE-2026-30894?

Informational severity, with a CVSS score of 6.9, published 26 May 2026.

Which products and versions are affected?

Joomla! Project Joomla! CMS 3.0.0-5.4.5, 6.0.0-6.1.0.

Is there a fix for CVE-2026-30894?

A patch was published on 2026-05-26: Fixed in versions 5.4.6 and 6.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30894 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-30894?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30894: Joomla! CMS XSS in content history component

CVE-2026-30894 · Severity: info · CVSS 6.9 · Published 2026-05-26

A vulnerability exists in the Joomla! Content Management System, which is used to build and manage websites. An attacker with high-level administrative privileges could inject malicious scripts into the content history component, potentially leading to unauthorized actions or data theft when other administrators view the history. This could compromise the integrity of the website management interface.

Quick answers

Is CVE-2026-30894 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30894 being exploited in the wild.
How severe is CVE-2026-30894?: Informational severity, with a CVSS score of 6.9, published 26 May 2026.
Which products and versions are affected?: Joomla! Project Joomla! CMS 3.0.0-5.4.5, 6.0.0-6.1.0.
Is there a fix for CVE-2026-30894?: A patch was published on 2026-05-26: Fixed in versions 5.4.6 and 6.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30894 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-30894?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Joomla! CMS 'com_contenthistory' component due to improper neutralization of input during web page generation (CWE-79). The root cause is a lack of output escaping when displaying content history records. An attacker with high privileges (PR:H) can inject malicious scripts that execute in the context of another user's browser session, typically requiring some form of user interaction (UI:P). This affects Joomla! versions 3.0.0 through 5.4.5 and 6.0.0 through 6.1.0. The issue is resolved in versions 5.4.6 and 6.1.1.

Affected products

Joomla! Project Joomla! CMS 3.0.0-5.4.5, 6.0.0-6.1.0

Timeline

2026-04-01: other: Reported to vendor
2026-05-26: patched: Fixed in versions 5.4.6 and 6.1.1
2026-05-26: disclosed: Public advisory published

References

https://developer.joomla.org/security-centre/1035-20260503-core-xss-in-com-contenthistory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.