This vulnerability (CVE-2026-30895) in Joomla! CMS is caused by improper neutralization of input during web page generation (CWE-79). Specifically, the readmore links in the com_content component do not properly escape output, which can lead to cross-site scripting attacks. The affected versions include Joomla! CMS 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability. No official fix or patch has been published by the Joomla! Project as of the data provided.

Successful exploitation could allow an attacker with high privileges and user interaction to execute arbitrary scripts in the context of the affected Joomla! CMS instance. This may lead to session hijacking, defacement, or other malicious actions limited by the partial impact on confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the Joomla! Project advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a patch is released, consider applying temporary mitigations such as disabling or restricting use of the affected readmore links component if feasible.