The vulnerability is a reflected cross‑site scripting flaw in the frontend controller of the JoomShopping extension for Joomla. The likely attack vector is the use of crafted URLs or form inputs containing malicious scripts, which can be reflected back in the browser. This allows an attacker to execute arbitrary JavaScript, potentially leading to defacement, cookie theft, session hijacking, or other malicious actions performed under the victim's identity. The weakness is a typical input‑validation issue, identified as CWE‑79.

The flaw affects all installations of the JoomShopping extension that are running a version older than 5.9.3. Versions 5.9.3 and later contain the mitigation that properly sanitizes or encodes user supplied data before it is output. Joomla core is not directly affected.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score indicates a very low but non‑zero probability of exploitation. It is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the exploit by visiting a crafted URL or submitting data through the product frontend, which is reachable to anyone visiting the site. Because the vulnerability does not require elevated privileges, directly user‑level or public users can exploit it, and the impact is limited to the victim's browser but can be leveraged to compromise credentials.