The Joomla! Core flaw arises from missing output escaping in its feed modules, creating a Cross‑Site Scripting (CWE‑79) vector. An attacker can embed malicious script into a feed entry, which is then rendered unescaped to any visitor. In a successful exploitation, the injected code runs within the victim’s browser, potentially hijacking sessions, stealing cookies, redirecting users, or defacing the site.

Joomla! Project’s Joomla! CMS installations that include the feed modules without the published patch are affected. Version information is not explicitly enumerated, so any deployment that has not applied the latest Joomla! update containing the XSS fix remains vulnerable.

The CVSS score of 6.9 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The attack vector is remote: a crafted feed entry can deliver harmful content to any user who accesses the feed, and no user credentials or elevated permissions are required.