The vulnerability is a reflected XSS flaw caused by a lack of output escaping in Joomla! CMS’s generic image output layout. An attacker can insert malicious JavaScript into a crafted URL or input that is processed and rendered by the browser when the image layout is displayed. The injected script runs in the context of the victim’s session, allowing the attacker to conduct actions such as stealing cookies, defacing content, or redirecting users to malicious sites. The weakness is identified as CWE‑79.

Joomla! Project’s Joomla! CMS is impacted. No specific affected versions are listed, so the flaw exists in the generic image output layout component of the CMS until the issue is resolved in a later release.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote: a victim must visit a maliciously crafted link that triggers the image output layout. Once the payload is executed, the attacker can run arbitrary client‑side code in the victim’s browser context.