This vulnerability (CVE-2026-25901) in Joomla! CMS is caused by improper neutralization of input during web page generation (CWE-79), specifically due to missing output escaping in the multilingual associations component. This flaw enables cross-site scripting attacks, where an attacker with high privileges and partial user interaction could inject malicious scripts that execute in the context of other users. The affected Joomla! versions are 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required for the attacker but high privileges are noted in the vector (PR:H), partial user interaction, and high impact on confidentiality, low on integrity and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to session hijacking, defacement, or other malicious actions within the Joomla! CMS environment. The impact is rated medium severity with a CVSS score of 6.9. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider limiting access to the multilingual associations component to trusted users only and monitor for suspicious activity related to this component. Avoid exposing the vulnerable versions publicly if possible.