The vulnerability arises from missing escaping in Joomla’s generic audio and video output layouts. An attacker can embed arbitrary JavaScript that will execute in the context of a user’s browser when the media view is loaded. This could lead to cookie theft, session hijacking, defacement, or other client‑side attacks. The weakness corresponds to uncontrolled input processing for output generation, identified as CWE‑79.

Joomla! CMS versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 are affected. Any site running a vulnerable Joomla release with the generic media layouts exposed to users could be compromised.

The CVSS score of 5.9 indicates moderate severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely publicly accessible, inferred from the fact that media output layouts are typically reachable by anyone who can view media files. An attacker does not need special privileges to exploit the issue, making the risk significant for sites that serve untrusted users.