This vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into a comment avatar field. The injected code is executed in the browsers of users who view the affected comments, enabling attackers to hijack sessions, deface pages, or steal sensitive data. The weakness corresponds to CWE‑79, which focuses on unsanitized HTML input leading to script execution.

The Gridbox extension for Joomla from balbooa.com, in all releases prior to version 2.20.2, is affected. Any site that runs that legacy version of the extension without an update is vulnerable.

The CVSS score of 6.1 indicates medium severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the web interface where users submit comments; an attacker can craft a comment with a malicious avatar image URL or embedded script. Successful exploitation requires the attacker to have the ability to post or modify comments on the target site.