# CVE-2026-92231: Joomla Core XSS filter bypass in InputFilter via HTML5 entity decode

Source: https://junglewise.ai/threats/cve-2026-92231-joomla-core-20260915-core-xss-filter-bypass-in-inputfilter-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-92231 · Severity: info · Published 2026-09-29

Joomla is a widely-used content management system that powers millions of websites. A flaw in its input filter allows attackers to bypass XSS protections by exploiting incomplete HTML5 entity decoding in attribute validation, potentially enabling unauthorized script execution on vulnerable sites.

Technologies: [Joomla! Joomla\!](https://junglewise.ai/threats/technologies/joomla). Vendors: [Joomla!](https://junglewise.ai/threats/vendors/joomla).

## Quick answers

**Is CVE-2026-92231 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92231 being exploited in the wild.

**How severe is CVE-2026-92231?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Joomla! Joomla\! 1.5.0–5.4.8, 6.0.0–6.1.3.

**Is there a fix for CVE-2026-92231?** A patch was published on 2026-09-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92231 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92231?** Check whether you run Joomla! Joomla\! at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The checkAttribute method in Joomla's InputFilter normalizes attribute values before testing them against a "javascript:" scheme regex, but fails to decode HTML5 entities before the check, allowing encoded payloads to bypass the filter. An attacker can inject HTML5 entity-encoded javascript: URIs into attributes, which normalize to valid scheme but are not caught by the regex. The vulnerability affects versions 1.5.0–5.4.8 and 6.0.0–6.1.3; patches were released on 2026-09-25.

## Affected products

- Joomla Joomla 1.5.0–5.4.8, 6.0.0–6.1.3

## Timeline

- 2026-09-29: disclosed
- 2026-09-25: patched

## References

- [https://developer.joomla.org/security-centre/1095-20260915-core-xss-filter-bypass-in-inputfilter-via-html5-entity-decode-mismatch.html](https://developer.joomla.org/security-centre/1095-20260915-core-xss-filter-bypass-in-inputfilter-via-html5-entity-decode-mismatch.html)
- [https://www.joomla.org/](https://www.joomla.org/)

## Related threats

- [Joomla Core XSS filter bypass in InputFilter with whitespace data URIs](https://junglewise.ai/threats/cve-2026-92232-joomla-core-20260916-core-xss-filter-bypass-in-inputfilter-via)
- [Joomla Core XSS in module list](https://junglewise.ai/threats/cve-2026-92225-joomla-core-20260912-core-xss-in-module-list-in-joomla-4-0-0-5-4)
- [Joomla Core improper ACL checks for workflow stage changes](https://junglewise.ai/threats/cve-2026-92223-joomla-core-20260910-core-improper-acl-checks-for-workflow-stage)
- [Joomla Core stored XSS in HTML mail templates](https://junglewise.ai/threats/cve-2026-90918-joomla-core-20260908-core-xss-in-html-mail-templates-in-joomla-4)
- [Joomla Core XSS in generic media output layouts](https://junglewise.ai/threats/cve-2026-90914-joomla-core-20260904-core-xss-in-the-generic-media-output-layouts)