A flaw in the Joomla! Framework Filter package’s cleanAttributes function fails to properly validate and filter input that contains HTML/JavaScript content, creating an opportunity for an attacker to inject malicious script into pages. An injected script can execute in the browsers of users who view the affected content, potentially allowing attackers to steal session cookies, hijack user accounts, or deface the site. The vulnerability is a classic XSS vector identified as CWE‑79.

The Joomla! Framework Filter package is affected. Specific version details are not disclosed in the CVE entry, so any installed instance using the default cleanAttributes implementation should be considered at risk.

The CVSS score of 6.9 classifies it as a moderate severity vulnerability. The EPSS score is not available and the issue is not listed in the CISA KEV catalogue, indicating that, while not widely exploited, the risk is present for sites that allow user‑generated content processed by the filter. The most likely attack path is client‑side; an attacker needs to craft an input that is rendered through the cleanAttributes filter, which is commonly exercised when user content is displayed on a Joomla! site.