This vulnerability (CVE-2026-21632) in Joomla! CMS is due to a lack of proper output escaping for article titles, which leads to cross-site scripting (CWE-79) vulnerabilities in various parts of the system. Affected versions include 4.0.0 to 5.4.3 and 6.0.0 to 6.0.3. The CVSS 4.0 base score is 5.9 (medium severity), indicating network attack vector, low attack complexity, no privileges required for the attacker but high privileges required for the exploit, and user interaction needed. The vulnerability impacts confidentiality and integrity to a high degree but has limited availability impact. No patch or vendor advisory is currently provided.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts via article titles, potentially affecting users who view those articles. This could lead to theft of user credentials, session hijacking, or other client-side attacks. However, the requirement for high privileges and user interaction limits the overall impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, monitoring the Joomla! Project advisories for updates is recommended. Avoid exposing high-privilege accounts unnecessarily and limit user interactions with untrusted content until a fix is released.