Is CVE-2026-90918 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90918 being exploited in the wild.

How severe is CVE-2026-90918?

Informational severity, published 29 September 2026.

Which products and versions are affected?

Joomla! Joomla\! 4.0.0-5.4.8, 6.0.0-6.1.3.

Is there a fix for CVE-2026-90918?

A patch was published on 2026-09-25: Fixed in versions 5.4.9 and 6.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-90918 attacked?

It is attacked with local access or over the network.

Am I affected by CVE-2026-90918?

Check whether you run Joomla! Joomla\! at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90918: Joomla Core stored XSS in HTML mail templates

CVE-2026-90918 · Severity: info · Published 2026-09-29

Joomla is a popular content management system used to build websites and online applications. The mail template feature lacks proper escaping, allowing attackers to inject malicious scripts that execute when emails are generated or processed. An attacker could exploit this to steal administrative credentials, hijack user sessions, or distribute malware through email functionality.

Technologies: Joomla! Joomla\!. Vendors: Joomla!.

Quick answers

Is CVE-2026-90918 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90918 being exploited in the wild.
How severe is CVE-2026-90918?: Informational severity, published 29 September 2026.
Which products and versions are affected?: Joomla! Joomla\! 4.0.0-5.4.8, 6.0.0-6.1.3.
Is there a fix for CVE-2026-90918?: A patch was published on 2026-09-25: Fixed in versions 5.4.9 and 6.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90918 attacked?: It is attacked with local access or over the network.
Am I affected by CVE-2026-90918?: Check whether you run Joomla! Joomla\! at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The mail template feature in Joomla CMS fails to properly escape user input or template variables, enabling stored cross-site scripting (XSS) attacks that affect multiple extensions. An authenticated attacker with mail template modification privileges can inject arbitrary JavaScript payloads that execute in the context of email rendering or administrative interfaces. The vulnerability has been patched in versions 5.4.9 and 6.1.4.

Affected products

Joomla Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Timeline

2026-09-29: disclosed
2026-09-25: patched: Fixed in versions 5.4.9 and 6.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.