This vulnerability in Joomla! CMS (CVE-2026-92231) involves an XSS filter bypass in the InputFilter component. The checkAttribute method attempts to detect and block JavaScript scheme injections by normalizing attribute values; however, it does not decode HTML5 entities before this check. This mismatch allows crafted input containing encoded entities to bypass the filter, leading to cross-site scripting. Affected versions include Joomla! 1.5.0 through 5.4.8, 6.0.0 through 6.1.3, 1.0.0 through 3.0.6, and 4.0.0 through 4.1.0.

Successful exploitation could allow an attacker with high privileges and partial user interaction to execute arbitrary scripts in the context of the affected Joomla! CMS instance. This can lead to session hijacking, defacement, or other malicious actions within the web application. The CVSS 4.0 score is 7.1 (high), reflecting network attack vector, low attack complexity, and partial user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Joomla! Project advisories for updates and apply patches once available. Until then, consider restricting user input and applying additional input validation or filtering as a temporary mitigation.