The vulnerability arises from insufficient output escaping of article titles in Joomla! CMS. Because titles are rendered without sanitization, an attacker who can set the title can insert malicious JavaScript. When a visitor loads the page where the title appears, the script runs in the user's browser, leading to potential credential theft, defacement, or malicious redirects. This is a classic stored XSS weakness (CWE‑79).

All Joomla! CMS installations that contain the affected code are impacted. The announcement does not list specific versions, so administrators should assume the issue exists in every release until a patch is applied. The vulnerability exists wherever article titles are output to the front‑end or administrative interface.

The CVSS score of 5.9 indicates moderate severity, while an EPSS below 1 % suggests low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation generally requires the ability to create or edit an article, meaning the attacker must have CMS editing rights or successfully compromise an account. If the attacker can meet that prerequisite, the compromised browsers can execute arbitrary scripts.