This vulnerability (CVE-2026-48951) in Joomla! CMS is due to lack of proper escaping of input during web page generation in modalreturn layouts across multiple components. This improper neutralization of input leads to cross-site scripting (CWE-79), which could allow an attacker with high privileges and partial user interaction to execute malicious scripts in the context of the affected web application. The CVSS 4.0 base score is 5.9, indicating medium severity. Affected versions include 4.0.0 to 5.4.6 and 6.0.0 to 6.1.1. No vendor advisory or patch is currently available, and no known exploits have been reported.

Successful exploitation could allow attackers with high privileges and some user interaction to execute arbitrary scripts in the context of the Joomla! CMS web application. This may lead to session hijacking, defacement, or other client-side impacts. However, the vulnerability requires user interaction and high privileges, limiting its impact scope. There are no known active exploits at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor Joomla! Project advisories for updates. Given the requirement for high privileges and user interaction, limiting administrative access and educating users may reduce risk temporarily.