Technology · Joomla!
Joomla! Joomla vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 24 vulnerabilities in Joomla! Joomla: 0 in the last 7 days and 9 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-92232, was published on 29 September 2026. Nothing in the last four weeks, down from 9 vulnerabilities in the four before.
- Last 7 days
- 0
- Last 90 days
- 9
- Critical, all time
- 2
- Exploited in the wild
- 1
About Joomla! Joomla
An open-source content management system for publishing web content.
Latest Joomla! Joomla vulnerabilities
- CVE-2026-92232: Joomla Core XSS filter bypass in InputFilter with whitespace data URIsinfo
- CVE-2026-92231: Joomla Core XSS filter bypass in InputFilter via HTML5 entity decodeinfo
- CVE-2026-92225: Joomla Core XSS in module listinfo
- CVE-2026-92223: Joomla Core improper ACL checks for workflow stage changesinfo
- CVE-2026-90918: Joomla Core stored XSS in HTML mail templatesinfo
- CVE-2026-90914: Joomla Core XSS in generic media output layoutsinfo
- CVE-2026-90913: Joomla Core improper ACL checks in webservice endpointsinfo
- CVE-2026-90906: Joomla Core cross-site scripting in HTMLHelper::link methodinfo
- CVE-2026-85190: Regular Labs Quick Index stored XSS via unescaped class attributeinfoEPSS 0.4%
- CVE-2026-65757: Regular Labs Modules Anywhere improper access control in editor popupinfo
- CVE-2026-64872: Regular Labs Cache Cleaner Pro path traversal in custom purge and log pathsinfo
- CVE-2026-48905: Joomla! CMS XSS in cleanAttributes filter codeinfoCVSS 6.9
- CVE-2026-48903: Joomla! CMS cross-site scripting in checkAttribute methodsinfoCVSS 6.9
- CVE-2026-30895: Joomla! CMS XSS in readmore links for com_contentinfoCVSS 6.9
- CVE-2026-30894: Joomla! CMS XSS in content history componentinfoCVSS 6.9
- CVE-2026-25900: Joomla! CMS cross-site scripting in feed modulesinfoCVSS 6.9
- CVE-2026-23899: An improper access check allows unauthorized access to webservice endpoints.highCVSS 8.8EPSS 0.4%
- CVE-2026-23898: Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.highCVSS 7.2EPSS 0.4%
- CVE-2026-21632: Lack of output escaping for article titles leads to XSS vectors in various locations.mediumCVSS 5.4EPSS 0.2%
- CVE-2026-21631: Lack of output escaping leads to a XSS vector in the multilingual associations component.mediumCVSS 5.4EPSS 0.2%
- CVE-2026-21630: Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.highCVSS 8.8EPSS 0.3%
- CVE-2026-21629: The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was…highCVSS 7.3EPSS 0.3%
- CVE-2023-23752: Joomla! Improper Access Control Vulnerabilitycriticalexploited in the wildCVSS 5.3
- CVE-2016-9081: Joomla! CMS account modification and password reset vulnerabilitycriticalCVSS 9.8
Most severe Joomla! Joomla vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2023-23752: Joomla! Improper Access Control Vulnerabilitycriticalexploited in the wildCVSS 5.3
- CVE-2016-9081: Joomla! CMS account modification and password reset vulnerabilitycriticalCVSS 9.8
- CVE-2026-23899: An improper access check allows unauthorized access to webservice endpoints.highCVSS 8.8EPSS 0.4%
- CVE-2026-21630: Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.highCVSS 8.8EPSS 0.3%
- CVE-2026-21629: The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was…highCVSS 7.3EPSS 0.3%
- CVE-2026-23898: Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.highCVSS 7.2EPSS 0.4%
- CVE-2026-21631: Lack of output escaping leads to a XSS vector in the multilingual associations component.mediumCVSS 5.4EPSS 0.2%
- CVE-2026-21632: Lack of output escaping for article titles leads to XSS vectors in various locations.mediumCVSS 5.4EPSS 0.2%
- CVE-2026-48905: Joomla! CMS XSS in cleanAttributes filter codeinfoCVSS 6.9
- CVE-2026-48903: Joomla! CMS cross-site scripting in checkAttribute methodsinfoCVSS 6.9
Vulnerabilities per week
Nothing in the last four weeks, down from 9 vulnerabilities in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 8 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Joomla! Joomla vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/joomla)<a href="https://junglewise.ai/threats/technologies/joomla"><img src="https://junglewise.ai/threats/technologies/joomla/badge.svg" alt="Joomla! Joomla vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/joomla.json, and this page as text at https://junglewise.ai/threats/technologies/joomla.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Joomla! Joomla vulnerabilities", https://junglewise.ai/threats/technologies/joomla, 9 November 2026.