An unauthenticated stored XSS vulnerability resides in the voting widget of DJ‑HelpfulArticles for Joomla. The widget accepts a client‑supplied IP address through an AJAX handler that is both reachable without authentication and lacks CSRF protection, and stores the value into the database verbatim. When an administrator views the helpful‑article votes, the unsanitized IP is rendered without escaping, permitting an attacker to inject and execute arbitrary script code in the administrator’s browser. This compromise can lead to credential theft, session hijacking, or the execution of arbitrary client‑side commands on any logged‑in administrator’s console.

The flaw applies to the DJ‑HelpfulArticles extension distributed by dj‑extensions.com for Joomla, affecting all releases with a version number lower than 1.3.0. No further vendor or product variations are documented, so any system running a pre‑1.3.0 release of the extension is vulnerable.

The CVSS base score of 8.7 marks the issue as high severity. An EPSS score is not available. The attacker can exploit the flaw simply by sending a crafted request to the AJAX voting endpoint; no authentication, CSRF token, or rate limiting is required. The resulting malicious script runs in the context of the administrator back‑end, providing the attacker with client‑side control over the admin console. The vulnerability is not listed in the CISA KEV catalog.