CVE-2026-48954 is a CWE-79 cross-site scripting vulnerability in Joomla! CMS caused by improper neutralization of input during web page generation in the language override feature. This vulnerability allows an attacker with high privileges to inject malicious scripts that can be executed by users, potentially leading to partial compromise of user sessions or data. The vulnerability affects Joomla! CMS versions 3.0.0 through 5.4.6 and 6.0.0 through 6.1.1. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts in the context of other users, potentially leading to session hijacking, information disclosure, or other impacts typical of cross-site scripting attacks. However, the attack requires high privileges and user interaction, limiting the scope of impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should limit high privilege access and consider disabling or restricting the language override feature if feasible. Monitor Joomla! Project advisories for updates.