CVE-2021-26030: Joomla core error page logo parameter XSS via inadequate escaping

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS rates it medium (6.1) and it requires user interaction, but the high EPSS score and unauthenticated network vector raise the practical risk for unpatched Joomla sites.

What it is

Joomla 3.0.0 through 3.9.25 fails to properly escape the logo parameter used by default templates on error pages, allowing reflected cross-site scripting. Because the flaw sits in core error handling, any site running an affected release is exposed without extra components.

Impact

An attacker can execute script in the context of the victim's browser session, enabling session theft, credential phishing or page manipulation on the affected Joomla site.

Attack surface

Reached over the network through a crafted request to an error page carrying a malicious logo parameter; no authentication is required, but the victim must be induced to load the crafted URL (UI:R).

Exploitation

Not listed in CISA KEV and no public exploit references are tagged beyond the vendor advisory, though EPSS is high at 0.82 (99.6th percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade Joomla to a release after 3.9.25 that contains the fix from the April 2021 security centre advisory.
• If immediate upgrade is not possible, restrict or filter the logo parameter on error pages at the web server or WAF.
• Deploy a content security policy that blocks inline and untrusted script execution to reduce XSS impact.
• Review and harden error page templates so user-supplied parameters are escaped before output.

Detection

• Search web and WAF logs for requests to Joomla error pages containing script-like payloads in the logo parameter.
• Monitor for reflected script content in error page responses, especially encoded or obfuscated payloads.
• Alert on outbound requests or session anomalies originating from users who recently hit crafted error page URLs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.