Lack of input filtering leads to an XSS vector in the HTML filter code.

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 5.4.6, or 6.x prior to 6.1.1. It is, therefore, affected by multiple vulnerabilities.

 - An XSS in feed modules due to lack of output escaping. (CVE-2026-25900)

 - An XSS in the multilingual associations component (com_associations). (CVE-2026-25901)

 - An XSS in the content history component (com_contenthistory). (CVE-2026-30894)

 - An XSS in readmore links. (CVE-2026-30895)

 - A CSRF in the admin user activation endpoint of com_users (6.x only). (CVE-2026-35220)

 - An authenticated blind SQL injection in the com_finder search query. (CVE-2026-35221)

 - An authenticated blind SQL injection in com_tags due to improperly validated order clauses. (CVE-2026-35222)

 - An improper access check in com_config webservice endpoints. (CVE-2026-35223)

 - A local file inclusion (LFI) in the HTMLView layout parameter due to improper input validation. (CVE-2026-40383)

 - A path traversal in the com_media webservice endpoint search parameter. (CVE-2026-40384)

 - An MFA authentication bypass via insufficient state checks. (CVE-2026-48896)

 - An MFA authentication bypass via incorrectly reset session states. (CVE-2026-48897)

 - A privilege escalation through the com_users batch task. (CVE-2026-48898)

 - A privilege escalation through the com_users group editing webservice endpoint. (CVE-2026-48904)

 - An incorrect access control in sample data plugins. (CVE-2026-48899)

 - An incorrect access control in com_scheduler allowing low-privileged users to modify task types. (CVE-2026-48900)

 - An incorrect cache key construction for InputFilter objects. (CVE-2026-48901)

 - A transport encryption downgrade for password and username reset links on HTTPS sites. (CVE-2026-48902)

 - Inadequate content filtering in the framework checkAttribute filter leading to XSS. (CVE-2026-48903)

 - Inadequate content filtering in the framework cleanAttributes filter leading to XSS. (CVE-2026-48905)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.0.x prior to 5.4.6 or 6.0.x prior to 6.1.1. It is, therefore, affected by a vulnerability.

  - Lack of input filtering leads to an XSS vector in the HTML filter code. (CVE-2026-48905)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
115257	Joomla! 6.x < 6.1.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
115256	Joomla! 3.x < 5.4.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
316827	Joomla 3.0.x < 5.4.6 / 6.0.x < 6.1.1 Joomla 6.1.1 & 5.4.6 Security & Bugfix Release (5954-joomla-6-1-1-5-4-6-security-bugfix-release)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2026-48905

medium

Tenable Plugins

high

high

medium