The EkRishta extension 2.10 contains persistent cross‑site scripting and SQL injection flaws that allow an attacker to inject malicious script into profile information fields such as Address and to execute arbitrary SQL statements via the phone_no POST parameter. The affected inputs are stored in the database and reflected when other users view the profile, giving the attacker code execution and data manipulation capabilities. The core weakness is identified as CWE‑89, reflecting improper handling of user input in SQL and web output contexts.

Any Joomla site that has installed EkRishta version 2.10 is affected. The vulnerability is present in the profile management and user_setting components of the extension. No other product versions are listed as affected in the current data.

Rated with a CVSS score of 8.8, the weakness represents a high‑severity threat. Because the EPSS score is not available, the likelihood of exploitation is unknown, but the vulnerability is exploitable through the public web interface of the extension. The vulnerability is not listed in the CISA KEV catalog, indicating there is no known large‑scale exploitation campaign at the time of this analysis. The likely attack vector is an authenticated or unauthenticated user submitting the malicious payload via the extension’s form controls, causing stored script execution and SQL manipulation.