Lack of output escaping leads to a XSS vector in the pagebreak plugin.

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.9.x prior to 5.4.2, or 6.x prior to 6.0.2. It is, therefore, affected by multiple vulnerabilities.

 - Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. (CVE-2025-63082)

 - Lack of output escaping leads to a XSS vector in the pagebreak and pagenavigation plugins. (CVE-2025-63083)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.9.x prior to 5.4.2 or 6.0.x prior to 6.0.2. It is, therefore, affected by a vulnerability.

  - Lack of output escaping leads to a XSS vector in the pagebreak plugin. (CVE-2025-63083)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
115101	Joomla! 6.x < 6.0.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
115100	Joomla! 3.9.x < 5.4.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
281853	Joomla 3.9.x < 5.4.2 / 6.0.x < 6.0.2 Joomla 6.0.2 & 5.4.2 Security & Bugfix Release (5942-joomla-6-0-2-and-5-4-2-security-bugfix-release)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2025-63083

high

Tenable Plugins

high

high

medium