The Vehicle Manager (Free) extension for Joomla contains a reflected XSS vulnerability. On the public vehicle-detail page (task=view) the title request parameter is echoed directly into a double‑quoted HTML attribute without encoding. An attacker can supply a title value that includes a double‑quote to break out of the attribute, allowing arbitrary markup—such as a <script> tag—to be injected into the page, enabling client‑side code execution in the victim’s browser.

All installations of ordasoft.com’s Vehicle Manager (Free) extension for Joomla whose version is earlier than 6.5.8 are affected. The vulnerable code resides in the public vehicle‑detail page (task=view).

The CVSS score of 5.3 indicates a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low to moderate exploitation likelihood. The vulnerability is reachable through a public URL, so a remote attacker can trigger it by sending a link to any user who visits the page. No authentication or privileged access is required for exploitation.