The vulnerability exists in the AJAX endpoint handlers of the RO CSVI extension for Joomla, allowing an attacker to inject malicious JavaScript. An attacker who can reach these endpoints can cause arbitrary code to execute in the victim’s browser, enabling session hijacking, credential theft, defacement or other browser‑side attacks. The weakness is a classic XSS flaw, as identified by CWE‑79.

The RO CSVI extension, sold by rolandd.com and used within Joomla CMS sites, is vulnerable in all releases older than version 9.11.0. Sites that have not applied that update should verify the extension version and upgrade to the fixed release or later.

The CVSS score of 6.1 reflects a moderate severity. The EPSS score is below 1%, indicating that the likelihood of exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. The attack surface is an AJAX endpoint that an attacker can invoke with crafted parameters; the payload is JavaScript code that will run in the context of its target users. Because the endpoint may be publicly reachable depending on configuration, the supply chain risk is that any user who can reach the endpoint could be targeted. The best mitigation is to upgrade to the patched version; if that cannot be done immediately, restricting or disabling the affected endpoints can reduce exposure.