This vulnerability (CVE-2026-48951) in Joomla! CMS is due to improper neutralization of input during web page generation (CWE-79). Specifically, lack of escaping in modalreturn layouts across multiple components leads to cross-site scripting issues. The CVSS 4.0 base score is 5.9 (medium severity), with network attack vector, low attack complexity, no privileges required but user interaction needed, and high impact on confidentiality, integrity, and availability. Affected versions include exactly 4.0.0 through 5.4.6 and 6.0.0 through 6.1.1. No patch or official remediation guidance is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected Joomla! CMS web application, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability requires user interaction and some privileges, limiting ease of exploitation. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input in modalreturn layouts and consider applying temporary mitigations such as input validation or disabling vulnerable components if feasible.