CVE-2021-23124: Joomla mod_breadcrumbs aria-label attribute XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw is a remotely reachable XSS with a high EPSS score and a broad affected version range, though it requires user interaction and is not in KEV.

What it is

Joomla! 3.9.0 through 3.9.23 fails to escape the aria-label attribute in the mod_breadcrumbs module, allowing cross-site scripting. The flaw is remotely reachable and can execute script in a victim's browser session, which matters for any site running an affected version.

Impact

An attacker can run arbitrary script in the context of the victim's browser, enabling session theft, credential capture or page defacement within the Joomla site.

Attack surface

Reached over the network through the breadcrumbs module output; the CVSS vector shows no privileges required but user interaction is required, so a victim must visit a crafted page or link.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged beyond the vendor advisory, but EPSS is high at 0.7896 (99.57th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Joomla! to a version later than 3.9.23 that contains the fix from the January 2021 security release.
• If immediate upgrade is not possible, disable or remove the mod_breadcrumbs module until patched.
• Apply output escaping or a WAF rule that blocks script injection in the aria-label parameter.
• Review and harden any custom templates that override mod_breadcrumbs output.
• Monitor the vendor security centre advisory for the official patch guidance.

Detection

• Search web and proxy logs for requests containing script tags or event handlers in breadcrumbs-related parameters.
• Inspect mod_breadcrumbs rendered output for unescaped aria-label values.
• Alert on anomalous JavaScript execution or DOM changes on pages that include the breadcrumbs module.
• Correlate Joomla version inventory to flag sites still running 3.9.0 through 3.9.23.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.