A reflected cross‑site scripting vulnerability exists in Joomla VirtueMart Shopping‑Cart 4.0.12. By injecting JavaScript payloads into the keyword parameter of the product‑variants endpoint, an attacker can cause arbitrary scripts to run in the browsers of visitors. This can lead to theft of session tokens, credentials, or other sensitive information from the victim’s browser. The flaw is a classic input‑validation weakness that allows malicious content to be reflected back to the client.

The vulnerability affects the VirtueMart Shopping‑Cart product, specifically version 4.0.12. Users running this version of the cart, including installations integrated with Joomla, are at risk.

The CVSS base score of 5.1 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw is triggered by a crafted URL containing a malicious keyword, an attacker only needs to entice a victim to visit the URL, making it potentially exploitable in phishing campaigns or spam links. No authentication or privileged access is required for exploitation.