# CVE-2026-90918: Joomla Core stored XSS in HTML mail templates

Source: https://junglewise.ai/threats/cve-2026-90918-joomla-core-20260908-core-xss-in-html-mail-templates-in-joomla-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-90918 · Severity: info · Published 2026-09-29

Joomla is a popular content management system used to build websites and online applications. The mail template feature lacks proper escaping, allowing attackers to inject malicious scripts that execute when emails are generated or processed. An attacker could exploit this to steal administrative credentials, hijack user sessions, or distribute malware through email functionality.

Technologies: [Joomla! Joomla\!](https://junglewise.ai/threats/technologies/joomla). Vendors: [Joomla!](https://junglewise.ai/threats/vendors/joomla).

## Quick answers

**Is CVE-2026-90918 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90918 being exploited in the wild.

**How severe is CVE-2026-90918?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Joomla! Joomla\! 4.0.0-5.4.8, 6.0.0-6.1.3.

**Is there a fix for CVE-2026-90918?** A patch was published on 2026-09-25: Fixed in versions 5.4.9 and 6.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90918 attacked?** It is attacked with local access or over the network.

**Am I affected by CVE-2026-90918?** Check whether you run Joomla! Joomla\! at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The mail template feature in Joomla CMS fails to properly escape user input or template variables, enabling stored cross-site scripting (XSS) attacks that affect multiple extensions. An authenticated attacker with mail template modification privileges can inject arbitrary JavaScript payloads that execute in the context of email rendering or administrative interfaces. The vulnerability has been patched in versions 5.4.9 and 6.1.4.

## Affected products

- Joomla Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

## Timeline

- 2026-09-29: disclosed
- 2026-09-25: patched: Fixed in versions 5.4.9 and 6.1.4

## References

- [https://developer.joomla.org/security-centre/1088-20260908-core-xss-in-html-mail-templates.html](https://developer.joomla.org/security-centre/1088-20260908-core-xss-in-html-mail-templates.html)
- [https://www.joomla.org/](https://www.joomla.org/)

## Related threats

- [Joomla Core XSS filter bypass in InputFilter with whitespace data URIs](https://junglewise.ai/threats/cve-2026-92232-joomla-core-20260916-core-xss-filter-bypass-in-inputfilter-via)
- [Joomla Core XSS filter bypass in InputFilter via HTML5 entity decode](https://junglewise.ai/threats/cve-2026-92231-joomla-core-20260915-core-xss-filter-bypass-in-inputfilter-via)
- [Joomla Core XSS in module list](https://junglewise.ai/threats/cve-2026-92225-joomla-core-20260912-core-xss-in-module-list-in-joomla-4-0-0-5-4)
- [Joomla Core improper ACL checks for workflow stage changes](https://junglewise.ai/threats/cve-2026-92223-joomla-core-20260910-core-improper-acl-checks-for-workflow-stage)
- [Joomla Core XSS in generic media output layouts](https://junglewise.ai/threats/cve-2026-90914-joomla-core-20260904-core-xss-in-the-generic-media-output-layouts)