Technical impact
The flaw in the Fabrik extension’s jsactions feature allows any unauthenticated user to inject malicious JavaScript into stored data. When a site visitor views a page that displays this data, the attacker's script executes in the victim’s browser, enabling session hijacking, cookie theft, data exfiltration, or defacement. The vulnerability is a classic stored XSS, classified as CWE-79, and can compromise the confidentiality and integrity of user sessions without requiring user interaction beyond page view.
Affected Systems
Any Joomla site that has the Fabrik extension installed with a version prior to 4.7.2 is affected. The vendor listed is fabrikar.com, and the product is the Fabrik extension for Joomla. No specific sub‑versions are enumerated beyond the major 4.7.2 cutoff, so sites using 4.6.x, 4.5.x, or any earlier 4.x releases are presumed vulnerable.
Risk and Exploitability
The CVSS score of 8.6 places the vulnerability in the high‑severity range, indicating significant risk if exploited. No EPSS score is available, so the exact probability of exploitation is unknown, but the unauthenticated nature of the exploit and the visible user‑interface interaction make it likely that attackers could readily test for and act on this flaw. The vulnerability is not currently listed in the CISA KEV catalog, but that does not mitigate the fact that attackers can leverage stored XSS to compromise site visitors and potentially inter‑site functionality. The best case scenario for an attacker is to hijack user sessions or inject unwanted content during normal browsing, with the attack vector being straightforward browser visit to a page that renders the stored JavaScript.
