This vulnerability in Joomla! CMS (CVE-2026-30895) involves improper neutralization of input during web page generation (CWE-79), specifically due to lack of output escaping in the readmore links of the com_content component. This flaw enables a cross-site scripting (XSS) vector that could be exploited by attackers to inject malicious scripts. The affected versions include 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 base score is 6.9, indicating medium severity, with network attack vector, low privileges required, and partial impact on confidentiality and availability. No official fix or patch is currently documented.

Successful exploitation could allow an attacker with some privileges and user interaction to execute malicious scripts in the context of the affected Joomla! CMS web pages, potentially leading to session hijacking or other client-side impacts. However, the impact is limited by the requirement for user interaction and some privileges, and the vulnerability does not affect system integrity or availability directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds from Joomla! Project advisories and avoid exposing vulnerable versions to untrusted users. Monitor Joomla! Project communications for updates and patches addressing this vulnerability.