Guardian language‑system exposes a reflected cross‑site scripting flaw because the id GET parameter is placed directly into HTML source and form action attributes on media.php. An attacker who is authenticated can craft a URL that contains HTML or script tags. When a logged‑in user visits the crafted link, the browser executes the injected code in that user’s session, allowing cookie theft or other client‑side actions on the victim’s behalf. The weakness is classified as CWE‑79.

The vulnerability exists in Guardian language‑system. No specific version numbers are listed, so any installation that contains the existing media.php without proper input sanitization may be affected. It remains uncertain whether recent releases have addressed the issue, as the description provides no version scope.

The CVSS score of 4.8 indicates moderate severity; the EPSS is listed as <1%, suggesting a very low but non‑zero likelihood of exploitation. The flaw is not included in the CISA KEV catalog. Exploitation requires the attacker to be authenticated, but the attack can be triggered simply by guiding the victim to a malicious URL. Consequently, the overall risk is mild unless user credentials are compromised or shared, at which point the attacker can leverage the reflected XSS to damage the victim’s session.