Lack of input filtering in the user avatar text field of the EasyDiscuss component for Joomla allows attackers to inject malicious scripts that are stored and displayed to other users. This persistent XSS can lead to theft of session cookies, defacement of user profiles, and the execution of arbitrary code in the victim’s browser. The weakness corresponds to CWE‑79, which focuses on improper handling of untrusted input.

The vulnerability affects Stackideas.com’s EasyDiscuss extension for Joomla, versions 1.0.0 through 5.0.15 inclusive. Systems running these versions of the component on any Joomla site are impacted, regardless of the host’s operating system or server configuration.

The CVSS score of 9.4 categorizes the flaw as critical in terms of impact. The EPSS score is below 1 %, indicating a very low probability of exploit at present, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers are likely to exploit the vulnerability by creating or editing a user profile to include malicious script tags in the avatar text; the injected payload is then rendered in the context of other users who view the profile, resulting in client-side compromise. Because the payload is stored in the database, the effect persists across sessions and users.