Improper validation of Joomla! Core’s language override feature allows arbitrary scripts to be included in language files, creating a generic cross‑site scripting vulnerability that can execute malicious code when the language resources are’s browser.

The affected product is Joomla! CMS from the Joomla! Project. No specific the advisory; administrators should verify whether their installation employs language override functionality and confirm the installed version.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of <1% suggests a very low is not listed in the CISA KEV catalog. The likely attack vector involves an attacker with sufficient privileges to modify language override files, typically via an administrative interface, enabling the injection of scripts that subsequently run in the browsers of site visitors and low exploitation probability.