CVE-2020-13763: Joomla!

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.

Affected products

• Joomla! Joomla!: from 2.5.1, before 3.9.19 (fixed in 3.9.19); version 2.5.0 only

Published 2020-06-02. Last modified 2026-06-17.