The J‑BusinessDirectory extension for Joomla contains a reflected Cross‑Site Scripting vulnerability that also permits XML injection. A request parameter named companyName is sent to the server and then directly inserted into an XML attribute without any escaping or sanitization. If a victim’s browser parses the resulting XML, the injected value can be interpreted as executable script, allowing an attacker to run arbitrary code in the victim’s browser in the context of the site. This flaw is client‑side only and does not alter server state beyond the browser execution environment.

All releases of cmsjunkie.com’s J‑BusinessDirectory extension for Joomla older than version 6.2.3 are affected. Administrators should confirm that their installations are at least 6.2.3; any version 6.2.2 or earlier remains vulnerable and requires remediation.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a reflected request: an attacker can craft a URL containing a malicious companyName parameter and lure a user to visit it. Because this flaw resides in client‑side output, it can be exploited remotely from the internet without authentication, potentially enabling defacement, phishing, or other client‑side compromise.