Every CVE Search/ Get API key

CVE-2025-54476

Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code

4.8 MediumFix available

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.31%Up 0.3 points since Oct 1, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.8

Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.

Record
CVE-2025-54476
CVSS 4.0
4.8 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2025-31744 4.8

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.

Record
EUVD-2025-31744
CVSS 4.0
4.8 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-fm22-g2q9-j3pw 4.8

Joomla! CMS vulnerable to XSS via the input filter

Improper handling of input could lead to a cross-site scripting (XSS) vector in the checkAttribute method of the input filter framework class.

Record
GHSA-fm22-g2q9-j3pw
CVSS 4.0
4.8 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
NVD 4.8

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.

Record
CVE-2025-54476
CVSS 4.0
4.8 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-fm22-g2q9-j3pw 4.8

Joomla! CMS vulnerable to XSS via the input filter

Improper handling of input could lead to a cross-site scripting (XSS) vector in the checkAttribute method of the input filter framework class.

Record
GHSA-fm22-g2q9-j3pw
CVSS 4.0
4.8 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
joomla/filter
Packagist
 4.0.0 to 4.0.0
4.0.1
joomla/filter
Packagist
 3.0.0 up to 3.0.5
3.0.5
joomla/filter
Packagist
 before 2.0.6
2.0.6
joomla/filter
Packagist
 4.0.0 up to 4.0.1
4.0.1
joomla/filter
Packagist
 3.0.0 up to 3.0.5, plus listed versions
3.0.13.0.23.0.33.0.4
3.0.5
joomla/filter
Packagist
 before 2.0.6, plus listed versions
1.01.0-alpha1.0-beta1.0-beta21.0-beta3
Show 34 moreShow less
1.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.3.01.3.11.3.21.3.31.3.41.3.51.4.01.4.11.4.21.4.31.4.41.4.51.4.61.4.72.0.02.0.0-beta2.0.0-beta22.0.0-beta32.0.0-beta42.0.0-beta52.0.0-rc2.0.12.0.22.0.32.0.42.0.5
2.0.6

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-54476 is a medium vulnerability (CVSS 4.8) in Joomla! Project Cms, published September 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in joomla/filter 4.0.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open