This vulnerability (CVE-2026-25900) in Joomla! CMS is due to improper neutralization of input during web page generation (CWE-79), specifically a lack of output escaping in feed modules. This flaw enables cross-site scripting (XSS) attacks, where an attacker with high privileges and partial user interaction could inject malicious scripts. The affected versions are 3.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required for attack initiation but high privileges for impact, partial user interaction, and high vulnerability and impact metrics. No official fix or patch has been published by the Joomla! Project as of the data provided.

Successful exploitation could allow attackers to execute arbitrary scripts in the context of the affected Joomla! CMS feed modules. This may lead to session hijacking, defacement, or other client-side impacts depending on the victim's privileges and interaction. The CVSS score of 6.9 reflects a medium severity impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Joomla! Project advisory for current remediation guidance. Until a fix is available, users should consider limiting access to feed modules or applying temporary mitigations if documented by the vendor. Monitor official Joomla! channels for updates and apply patches promptly once released.