The Joomla! Content Management System’s multilingual associations component fails to escape output in its comparison view, enabling an attacker to inject malicious JavaScript that runs in the browsers of any user who visits the affected page. This client‑side code execution can be used for phishing, cookie theft, or defacement of the site within the victim’s browser context.

Any Joomla! installation that includes the com_associations component prior to the March 3 2026 advisory is potentially vulnerable. The flaw applies to all versions of the component that were in use before the patch was released; no specific version range was specified in the advisory, so sites should assume the default multilingual associations feature is at risk.

The CVSS base score of 5.9 places the issue in the medium severity range, and the reported exploitation likelihood is very low (less than one percent). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. It is presumably triggered through the web interface when an attacker supplies unescaped data—such as a crafted URL parameter or form field—that is rendered in the comparison view. The impact is limited to the victim’s browser, but successful exploitation would give the attacker full access to that browser’s scripting environment.