Solidres 2.13.3 contains a reflected cross‑site scripting flaw that lets attackers embed malicious script code into several GET parameters such as show, reviews, type_id, distance, facilities, categories, prices, location, and Itemid. When a victim opens a URL carrying a JavaScript payload in any of these parameters, the code runs in the visitor’s browser. This can enable an attacker to steal session tokens, capture login credentials, or alter the presentation of the site.

The vulnerability affects the Solidres extension for Joomla, version 2.13.3. No other product variants or earlier versions are listed as vulnerable in the supplied data.

The CVSS value of 5.1 points to a moderate severity. Exploit probability data is absent, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication by delivering specially crafted URLs to targeted users, typically through phishing or social engineering. Successful exploitation can lead to session hijacking, credential theft, and content manipulation, so the risk to high‑traffic sites is significant despite the moderate score.