The vulnerability resides in the Media Picker component of Helix Ultimate for Joomla—any data entered through the picker is stored without proper sanitization, enabling an attacker to embed malicious scripts that will execute in the browsers of users who view the affected media. This stored cross‑site scripting can lead to session hijacking, disclosure of client‑side information, or further client‑side attacks executed in the victim’s context. The weakness is a classic CWE-79 scenario where input is not adequately filtered before being rendered.

The Helix Ultimate extension for Joomla provided by joomshaper.com is affected. Versions earlier than 2.2.11 allow the vulnerability to be exercised; newer releases contain the necessary input validation to prevent script injection.

The CVSS base score of 8.6 classifies it as high severity, indicating considerable risk when the flaw is exploitable. With no EPSS score available and no listing in the CISA KEV catalog, the public exploitation record is not yet confirmed but the weakness remains open for attackers with upload privilege. The likely attack path involves an attacker with the ability to upload or modify media through the Helix Media Picker, persisting malicious code that is subsequently rendered to any site visitor.