CVE-2026-73336: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Joomla! Project Joomla! CMS
CVE-2026-73336 is a medium severity cross-site scripting (XSS) vulnerability in Joomla! CMS affecting versions 5.1.0 through 5.4.6 and 6.0.0 through 6.1.2. The flaw arises from improper escaping in schema.org markup outputs, which could allow an attacker to inject malicious scripts. The vulnerability does not require user interaction and has a low complexity for exploitation, but it requires high privileges to exploit. No known exploits are reported in the wild, and no official patch information is provided in the input data.
AI Analysis
Technical Summary
Joomla! CMS versions 5.1.0-5.4.6 and 6.0.0-6.1.2 contain an XSS vulnerability due to improper neutralization of input during web page generation specifically in schema.org markup outputs. This improper escaping leads to a cross-site scripting vector that could be exploited by an attacker with high privileges to inject malicious scripts into web pages generated by Joomla!.
Potential Impact
An attacker with high privileges could exploit this vulnerability to execute arbitrary scripts in the context of the affected Joomla! CMS web pages. This could lead to actions such as session hijacking, defacement, or other malicious activities depending on the context of the injected script. However, the vulnerability has low attack vector and impact complexity, and no known active exploitation is reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access and review schema.org markup usage to minimize exposure.
CVE-2026-73336: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Joomla! Project Joomla! CMS
Description
CVE-2026-73336 is a medium severity cross-site scripting (XSS) vulnerability in Joomla! CMS affecting versions 5.1.0 through 5.4.6 and 6.0.0 through 6.1.2. The flaw arises from improper escaping in schema.org markup outputs, which could allow an attacker to inject malicious scripts. The vulnerability does not require user interaction and has a low complexity for exploitation, but it requires high privileges to exploit. No known exploits are reported in the wild, and no official patch information is provided in the input data.
CVSS v4.0
Score 5.1medium
Affected software
Joomla! Project
Joomla! CMS
pkg:composer/joomla/joomla-cmsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Joomla! CMS versions 5.1.0-5.4.6 and 6.0.0-6.1.2 contain an XSS vulnerability due to improper neutralization of input during web page generation specifically in schema.org markup outputs. This improper escaping leads to a cross-site scripting vector that could be exploited by an attacker with high privileges to inject malicious scripts into web pages generated by Joomla!.
Potential Impact
An attacker with high privileges could exploit this vulnerability to execute arbitrary scripts in the context of the affected Joomla! CMS web pages. This could lead to actions such as session hijacking, defacement, or other malicious activities depending on the context of the injected script. However, the vulnerability has low attack vector and impact complexity, and no known active exploitation is reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access and review schema.org markup usage to minimize exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Joomla
- Date Reserved
- 2026-08-12T09:07:21.642Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a84862fc6e8be03327406c8
Added to database: 08/18/2026, 16:19:59 UTC
Last enriched: 09/11/2026, 21:19:00 UTC
Last updated: 10/02/2026, 12:52:50 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.