CVE-2026-92232

MediumCVSS 6.5/10Last modified Oct 6, 2026

Description

Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 29, 2026
Last modified
Oct 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-922345.4QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System featCVE-2026-922358.1The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. CVE-2026-922376.5Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier CVE-2026-922389.8A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulneraCVE-2026-922398.1A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 1CVE-2026-92244.3Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify theirCVE-2026-922409.1A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response,CVE-2026-922436.1The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in allCVE-2026-922447.2The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / CVE-2026-922457.5The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, CVE-2026-922474.7A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/filCVE-2026-922487.8A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image