Description
An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Joomla! Project | Joomla! CMS | 3.0.0-3.9.27 | — |
Unscored
CVE-2021-26035
EUVD-2021-12858GHSA-2vpx-cqm4-rqhq
[20210701] - Core - XSS in JForm Rules field
Published Jul 7, 2021 · Updated Feb 25, 2026 · Assigned by Joomla