Joomla! CMS Cross-Site Scripting Vulnerability Advisory (CVE-2026-73336)

Vulnerability Overview Project Name: Joomla! Subproject: CMS Impact: Medium Severity: Medium Probability: Low Version: 5.1.0-5.4.7, 6.0.0-6.1.2 Exploitation Type: XSS Report Date: 2026-07-21 Patch Date: 2026-08-18 CVE ID: CVE-2026-73336 Scope of Impact Affected Installations: Joomla! CMS versions 5.1.0-5.4.7, 6.0.0-6.1.2 Remediation Solution: Upgrade to versions 5.4.8, 6.1.3 Description Improper escaping flags result in XSS vectors appearing in schema.org tag output. Contact Information Reporter: Amin Isayev, Geo (GitHub.com/geo-chen) Contact Point: Joomla! Security Centre Additional Information Current Version: 6.x Known Issues: View known issues Development Status: View development status Nightly Builds: Download nightly builds Resources Development Strategy: View development strategy Product Roadmap: View product roadmap Planned Features: View planned features Security Announcements: View security announcements Report Security Issues: Report security issues Generative AI Policy: View Generative AI policy Usage Statistics: View usage statistics Statistics API: View statistics API Documentation: View documentation Joomla! API Documentation: View Joomla! API documentation Coding Standards Manual: View coding standards manual Joomla! Code Archive: View Joomla! code archive Mailing Lists Developer Network Newsletter: Subscribe to Developer Network newsletter General Extensions Mailing List: Subscribe to General extensions mailing list CMS Mailing List: Subscribe to CMS mailing list Framework Mailing List: Subscribe to Framework mailing list Documentation Mailing List: Subscribe to Documentation mailing list Footer Information Copyright: © 2005 - 2026 Open Source Matters, Inc. All rights reserved. Sponsor: DPG A Digital Public Good. Branding: ROCHEN Joomla! Hosting by Rochen Navbar Home: Home News: News Project Roadmap: Project Roadmap CMS: CMS Framework: Framework Tracker: Tracker About: About Security: Security Footer Links Home: Home About: About Community: Community Forums: Forums Extensions: Extensions Services: Services User Guide: User Guide Developers: Developers Store: Store Accessibility Statement: Accessibility Statement Privacy Policy: Privacy Policy Cookie Policy: Cookie Policy Sponsor Joomla! $5: Sponsor Joomla! $5 Help Translate: Help Translate Report an Issue: Report an Issue Login: Login Social Media Links Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Instagram: Instagram YouTube: YouTube Other Links Joomla! Developer Network: Joomla! Developer Network Joomla! Developer Network™: Joomla! Developer Network™ Downloads: Downloads Launch: Launch Search Box Search: Search Footer Branding ROCHEN: ROCHEN Joomla! Hosting by Rochen: Joomla! Hosting by Rochen Footer Copyright © 2005 - 2026 Open Source Matters, Inc. All rights reserved.: © 2005 - 2026 Open Source Matters, Inc. All rights reserved. Footer Sponsor DPG A Digital Public Good.: DPG A Digital Public Good. Footer Branding ROCHEN: ROCHEN Joomla! Hosting by Rochen: Joomla! Hosting by Rochen Footer Copyright © 2005 - 2026 Open Source Matters, Inc. All rights reserved.: © 2005 - 2026 Open Source Matters, Inc. All rights reserved. Footer Sponsor DPG A Digital Public Good.: DPG A Digital Public Good. Footer Branding ROCHEN: ROCHEN Joomla! Hosting by Rochen: Joomla! Hosting by Rochen Footer Copyright © 2005 - 2026 Open Source Matters, Inc. All rights reserved.: © 2005 - 2026 Open Source Matters, Inc. All rights reserved. Footer Sponsor DPG A Digital Public Good.: DPG A Digital Public Good. Footer Branding ROCHEN: ROCHEN Joomla! Hosting by Rochen: Joomla! Hosting by Rochen Footer Copyright © 2005 - 2026 Open Source Matters, Inc. All rights reserved.: © 2005 - 2026 Open Source Matters, Inc. All rights reserved. Footer Sponsor DPG A Digital Public Good.: DPG A Digital Public Good. Footer Branding ROCHEN: ROCHEN Joomla! Hosting by Rochen: Joomla! Hosting by Rochen Footer Copyright © 2005 - 2026 Open Source Matters, Inc. All rights reserved.: © 2005 - 2026 Open Source Matters, Inc. All rights reserved. Footer Sponsor DPG A Digital Public Good.: DPG A Digital Public Good. Footer Branding ROCHEN: ROCHEN Joomla! Hosting by Rochen: Joomla! Hosting by Rochen Footer Copyright © 2005 - 2026 Open Source Matters, Inc. All rights reserved.: © 2005 - 2026 Open Source Matters, Inc. All rights reserved. Footer Sponsor DPG A Digital Public Good.: DPG A Digital Public Good. Footer Branding ROCHEN: ROCHEN Joomla! Hosting by Rochen: Joomla! Hosting by Rochen Footer Copyright © 2005 - 2026 Open Source Matters, Inc. All rights reserved.: © 2005 - 2026 Open Source Matters, Inc. All rights reserved. Footer Sponsor DPG A Digital Public Good.: DPG A Digital Public Good. Footer Branding ROCHEN: ROCHEN Joomla! Hosting by Rochen: Joomla! Hosting by Rochen Footer Copyright © 2005 - 2026 Open Source Matters, Inc. All rights reserved.: © 2005 - 2026 Open Source Matters, Inc. All rights reserved. Footer Sponsor DPG A Digital Public Good.: DPG A Digital Public Good. Footer Bran

Goal Reached Thanks to every supporter — we hit 100%!

Joomla! CMS Cross-Site Scripting Vulnerability Advisory (CVE-2026-73336)