A reflected XSS flaw exists when the Book Library (Free) extension’s public book-detail page echoes the raw title request parameter directly into a double‑quoted attribute without any escaping. An attacker can embed a double quote and arbitrary HTML or JavaScript into the title value, causing the browser to execute the injected payload in the context of the site. This can lead to theft of session data, credential hijacking, or defacement of the website, affecting the confidentiality and integrity of all visitors who view the page.

The vulnerability affects Ordasoft.com’s Book Library (Free) extension for Joomla prior to version 6.4.6. Any installation of this extension below that version is susceptible to the issue.

With a CVSS score of 5.3 the flaw is considered moderate severity. The EPSS score is not available, but the lack of authentication requirements and the simplicity of crafting a malicious URL mean exploitation potential is high. The attack vector is clearly web‑based and the vulnerability resides in a public page that does not require privileges.