CVE-2026-30894 is a cross-site scripting vulnerability (CWE-79) in the Joomla! CMS content history component caused by insufficient output escaping. This flaw allows an attacker with high privileges to inject malicious scripts that execute in the context of other users who view the affected content history pages. The vulnerability affects Joomla! versions 3.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack prerequisites, partial user interaction, and high impact on confidentiality, with limited impact on integrity and availability. No vendor patch or official remediation has been published as of the vulnerability disclosure date.

Successful exploitation could allow a privileged attacker to execute arbitrary scripts in the context of other users viewing the content history component, potentially leading to session hijacking, information disclosure, or other XSS-related impacts. The vulnerability requires high privileges and some user interaction, limiting the scope of exploitation. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the content history component to trusted users only and apply any available Joomla! security best practices relevant to XSS mitigation. Monitor official Joomla! Project advisories for updates on patches or workarounds.