This vulnerability arises from a lack of input filtering in the Easy Discuss forum post handling. Stored posts can contain arbitrary script tags that are served unchanged to any user who reads the thread. An attacker can embed malicious JavaScript that will run in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or phishing attacks.

Stackideas EasyDiscuss component for Joomla, versions 1.0.0 through 5.0.15. All releases within that range can be exploited by users who can post forum content.

The CVSS score is 9.4, indicating a high‑severity flaw. Exploit probability is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to create a malicious forum post; the impact manifests when victims view the thread. No public exploit has been documented, but similar XSS attacks can be performed quickly once the flaw is known.