CVE-2021-26030
[20210401] - Core - Escape xss in logo parameter error pages
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
- Record
CVE-2021-26030- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
[20210401] - Core - Escape xss in logo parameter error pages
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
- Record
CVE-2021-26030- Updated
- 2026-11-02
EUVDEUVD-2021-12853 No score
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
- Record
EUVD-2021-12853- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f8r2-5wfg-hq3j No score
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks...
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
- Record
GHSA-f8r2-5wfg-hq3j- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
- Record
CVE-2021-26030- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVBIT-joomla-2021-26030 No score
[20210401] - Core - Escape xss in logo parameter error pages
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
- Record
BIT-joomla-2021-26030- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
joomlaBitnami |
3.0.0 to 3.9.25 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-26030 is a medium vulnerability (CVSS 6.1) in Joomla Joomla\!, published April 14, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 82.8%, the 99th percentile. No source names a fixed version.