# CVE-2026-92224: Joomla Core XSS in link toolbar layout

Source: https://junglewise.ai/threats/cve-2026-92224-joomla-core-20260911-core-xss-in-link-toolbar-layout-in-joomla-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-92224 · Severity: info · Published 2026-09-29

Joomla is a content management system that enables organizations to build and manage websites and online applications. The link toolbar layout component fails to properly escape user input, allowing attackers to inject malicious scripts. An attacker with access to create or edit content could execute arbitrary JavaScript in the browsers of other users, potentially stealing session tokens, credentials, or defacing content.

Vendors: [Joomla! Project](https://junglewise.ai/threats/vendors/joomla-project).

## Quick answers

**Is CVE-2026-92224 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92224 being exploited in the wild.

**How severe is CVE-2026-92224?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Joomla! Project Joomla 4.0.0-5.4.8, 6.0.0-6.1.3.

**Is there a fix for CVE-2026-92224?** A patch was published on 2026-09-25: Fix released in versions 5.4.9 and 6.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92224 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92224?** Check whether you run Joomla! Project Joomla at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the link toolbar layout component that fails to sanitize or escape user-supplied input before rendering it in the UI. An attacker with content editing permissions can inject malicious JavaScript payloads through link toolbar inputs. The vulnerability affects Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3, with patches released in versions 5.4.9 and 6.1.4.

## Affected products

- Joomla Project Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

## Timeline

- 2026-09-29: disclosed: CVE-2026-92224 published
- 2026-09-25: patched: Fix released in versions 5.4.9 and 6.1.4

## References

- [https://developer.joomla.org/security-centre/1091-20260911-core-xss-in-link-toolbar-layout.html](https://developer.joomla.org/security-centre/1091-20260911-core-xss-in-link-toolbar-layout.html)
- [https://www.joomla.org/](https://www.joomla.org/)