The Joomla! CMS Multimedia Associations component suffers from a lack of output escaping, creating an XSS vulnerability identified by CWE‑79. An attacker can inject malicious JavaScript that executes in the browsers of users interacting with the affected pages, potentially permitting defacement, credential theft, or session hijacking. The impact is confined to the web application context and does not provide a direct privilege escalation or remote code execution path.

The affected product is Joomla! Project Joomla! CMS. Specific version information is not provided in the advisory, so all releases that include the multilingual associations component are potentially impacted until a patch is applied.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not available, limiting precise exploitation likelihood assessment. The vulnerability is not listed in the CISA KEV catalog. Exploitation is inferred to be possible remotely through crafted URLs or page inputs that trigger unescaped output, making it accessible to any user visiting the site. Overall risk is moderate, with a realistic likelihood that the flaw could be abused by attackers with moderate skill and resources.