The flaw is a reflected XSS vulnerability (CWE‑79) in the Dynamic Content Filter addon of the SP Page Builder Pro extension for Joomla, affecting versions 3.0.0 through 5.6.1p2. The slider’s minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", then HTML‑escaped inside a data‑value attribute but echoed without escaping as a span element’s text content. This allows an attacker to inject arbitrary HTML or JavaScript that is rendered in the page when a crafted dc_filter_<fieldId> value is supplied.

Joomla sites that have the SP Page Builder Pro extension from joomshaper.com installed in any version between 3.0.0 and 5.6.1p2 are impacted. Site administrators should verify the installed version of the extension to determine vulnerability exposure.

The CVSS score of 5.3 indicates a medium severity reflected XSS. The EPSS score is not available, but because no authentication is required, any visitor to an affected page can exploit the flaw. The vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed widespread exploitation yet. If abused, the attacker could tamper with page content, steal session cookies, or conduct phishing attacks against users.