CVE-2024-21726: Joomla core filter code allows cross-site scripting

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityHigh EPSS and a public exploit reference indicate likely active exploitation, and the flaw is unauthenticated and remotely reachable, though CVSS severity is only medium.

What it is

Joomla's core content filtering is inadequate, allowing cross-site scripting in multiple components. The flaw is remotely reachable without authentication or user interaction, so it can be triggered against any site running an affected Joomla release. Because Joomla is widely deployed and the issue affects core filtering rather than a single extension, the exposure is broad.

Impact

An attacker can inject script that executes in a victim's browser session, enabling session theft, credential capture, or actions performed as the victim. The CVSS vector limits direct confidentiality and availability impact to low, so the primary gain is client-side compromise rather than server takeover.

Attack surface

Reached over the network via HTTP requests to Joomla components that use the core filter code; the vector shows no privileges required and no user interaction required. The description does not name the specific components or parameters, so exact entry points must be confirmed against the vendor advisory.

Exploitation

Not listed in CISA KEV, but EPSS is 0.48839 (98.8th percentile), indicating high predicted exploitation activity. A third-party reference is tagged Exploit, so public technical detail on the XSS exists.

What to do

• Apply the Joomla core security update referenced in the vendor advisory (developer.joomla.org security centre 929) as the first action.
• If immediate patching is not possible, restrict or disable the affected components and review input filtering configuration.
• Deploy a web application firewall rule set that blocks script payloads in request parameters reaching Joomla components.
• Set Content-Security-Policy and HttpOnly/Secure cookie flags to reduce the impact of any successful script injection.
• Audit for and remove unused third-party extensions that rely on the core filter code.

Detection

• Search web server and WAF logs for requests containing script tags, event handlers, or encoded script payloads in Joomla component parameters.
• Monitor for anomalous outbound requests or injected content in Joomla responses that were not present in stored content.
• Review application logs for repeated 200 responses to requests with suspicious filter-bypass patterns from the same source.
• Check for unexpected changes to Joomla content or configuration that could indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.