CVE-2026-73336CWE-79cross-site-scripting

CVE-2026-73336

Medium · published August 18, 2026

CVSS v3.1

6.4

EPSS

Percentile

17.5

In the wild

Unconfirmed

What it is

Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs.

The record

Technical detail

CVSS v3.1: 6.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0: 5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00266 · 17.5th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-08-18T21:17Z

Affected products (2)

Product	Versions	Fixed in
joomla/joomla\!	≥ 5.1.0, < 5.4.8	5.4.8
joomla/joomla\!	≥ 6.0.0, ≤ 6.1.3	—

References (2)

https://developer.joomla.org/security-centre/1073-20260806-core-xss-through-schema-org-outputs.html · [email protected]https://www.joomla.org/ · [email protected]

EPSS history

Timeline

18 AUG 16:06Z
Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2
cvelistv5