Joomla! CMS versions 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3 contain a cross-site scripting vulnerability (CWE-79) in the HTML mail templates feature. The vulnerability is due to improper neutralization of input during web page generation, specifically a lack of escaping in mail templates, which can lead to XSS vectors in multiple extensions. The CVSS 4.0 base score is 6.9, indicating a medium severity. The vulnerability is publicly known as CVE-2026-90918. There is no vendor advisory or patch link provided in the input data.

Successful exploitation could allow an attacker to inject malicious scripts into mail templates, potentially affecting users who view these mails or related interfaces. This could lead to unauthorized actions or data exposure within the context of the affected Joomla! CMS installations. However, no known exploits are reported in the wild, and the impact is limited to the affected versions and the mail template feature.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of mail templates that accept user input or apply manual input sanitization where possible.