CVE-2026-92231 – Joomla! Core – [20260915] – Core – XSS filter bypass in InputFilter via HTML5 entity decod

Joomla! Core – [20260915] – Core – XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 – The checkAttribute method normalized an attribute value before testing it against the “javascript:” scheme regex, however without decoding HTML5 entities beforehand, causing an XSS vector.