Inadequate content filtering in the Joomla! Framework checkAttribute methods enables malicious code to be injected into HTML attributes, resulting in Cross‑Site Scripting. An attacker can craft payloads that execute in the victim’s browser, potentially allowing credential theft, session hijacking, or defacement of web pages. The vulnerability is a classic input validation flaw (CWE‑79).

The Joomla! Project’s Joomla! Framework Filter package is affected. No specific version ranges are listed in the public data, so all installations using the current checkAttribute implementation are potentially vulnerable until a patch is applied.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, so no public evidence of exploitation is known. The likely attack vector is client‑side via untrusted input that is not properly sanitized before being inserted into HTML attribute values. If an attacker can supply such input through any exposed form or data field, the risk of successful exploitation is plausible. The absence of a KEV listing means that defenders may not have seen widespread real‑world attacks yet, but the moderate score and absence of mitigation advice warrant timely action.