Joomla JLex Review 6.0.1 contains a reflected cross‑site scripting flaw that lets an attacker supply a malicious payload through the review_id URL parameter. When a victim visits a crafted link, the embedded script runs in the victim's browser, allowing session hijacking or credential theft. The vulnerability does not require authentication or additional privileges, so any user who follows a malicious link can be exposed.

The flaw is present only in the JLexart Joomla JLex Review extension, version 6.0.1. No other product or version is listed as affected. Site owners using this specific extension version should verify its presence on their deployment.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not catalogued in the CISA KEV list. Based on the description, it is inferred that the attacker can exploit this weakness by sending phishing emails or embedding the link in other content that drives users to the vulnerable URL. The vulnerability has been demonstrated by publicly available exploits, showing that it can be leveraged without additional prerequisites.