The vulnerability arises from a lack of escaping in the mail template feature of Joomla. Malicious content injected into HTML email templates can be rendered as active script when the recipient's email client or webmail interface displays the message. This can lead to cross‑site scripting attacks that may steal session cookies, deface pages, or execute arbitrary JavaScript in the context of the victim's browser. The flaw is a classic example of CWE‑79 and is reported with a CVSS score of 6.9.

Affected users are those running Joomla! CMS versions 4.0.0 through 5.4.8 or 6.0.0 through 6.1.3. All of these releases rely on the mail template engine that does not sanitise output, meaning that any extension that creates or injects HTML into the templates is potentially vulnerable. The vulnerability is present in the core product managed by the Joomla! Project.

The CVSS score of 6.9 indicates moderate severity, and because the EPSS score is not listed, there is no published estimate of exploitation probability. The vulnerability is not recorded in CISA’s KEV catalog, suggesting no widespread exploitation has been documented yet. However, the nature of XSS means that a local or remote attacker could craft a payload that will execute in the browsers of recipients or administrators who open the affected emails. The attack vector is inferred as “web‑client user interaction” because the vulnerable code is executed when an email is rendered in a browser; further exploitation would require the victim to view the injected content.