This vulnerability (CVE-2026-25901) in Joomla! CMS is caused by improper neutralization of input during web page generation (CWE-79). Specifically, the multilingual associations component does not properly escape output, enabling a cross-site scripting vector. The affected versions include 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 base score is 6.9, indicating medium severity, with network attack vector, low privileges required, and partial impact on confidentiality, integrity, and availability. No patch or official fix has been documented in the provided data.

Successful exploitation could allow an attacker with high privileges and user interaction to execute arbitrary scripts in the context of the affected Joomla! CMS instance, potentially leading to partial compromise of confidentiality, integrity, or availability of the system or user data. However, the impact is limited by the requirement for user interaction and high privileges.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider limiting access to the multilingual associations component and applying any recommended temporary mitigations from the vendor. Monitor official Joomla! communications for updates.