The StageIt Joomla extension versions 1.0 through 5.7.5 and 6.0 through 6.3.5 contain a reflected cross‑site scripting flaw. Input supplied by a user is inserted directly into the HTML response without proper escaping, allowing an attacker to embed malicious JavaScript in a URL, form field or other request parameter. When the victim clicks the crafted link or visits the vulnerable page, the script executes in the victim’s browser context with the same privileges as the Joomla site, enabling defacement, session hijacking, or further malware delivery. The weakness is classified as CWE‑79 and provides potential for impacting confidentiality through data theft, integrity through unauthorized content injection, and availability through malicious page rendering.

This vulnerability affects the StageIt extension for Joomla developed by php‑web‑design.com. All released versions from 1.0 up to 5.7.5 and from 6.0 to 6.3.5 are impacted. Joomla site owners using any of these versions should confirm the installed extension version and assess whether the site is exposed to unauthenticated or limited‑auth requests that can trigger XSS.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, so the current exploitation probability cannot be precisely quantified, but reflected XSS vulnerabilities are widely known to be relatively easy to exploit. The flaw is not listed in the CISA KEV catalog. Likely attack vectors involve unauthenticated or low‑privilege users sending malicious requests that include script payloads; the vulnerability does not require administrator access as it is reflected directly in page output.