The Joomla! core’s link toolbar layout fails to escape user supplied inputs, allowing attackers to inject and execute malicious JavaScript code in the victim’s browser. This client‑side XSS vulnerability can lead to defacement, cookie theft, or session hijacking. The flaw is a classic input‑validation issue, identified as CWE‑79.

Versions of Joomla! CMS from 4.0.0 through 5.4.8 and from 6.0.0 through 6.1.3 are affected. The affected component is the link toolbar layout within the core editor interface used by all Joomla! sites that employ these CMS versions.

The vulnerability has a medium CVSS score of 5.9, and no EPSS score is available. It is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. Attackers can trigger this flaw by causing a victim to view a page that includes the unescaped link toolbar, which requires no authentication. The window of opportunity therefore relies on the victim’s interaction with the affected page, but once triggered the malicious script runs with the same privileges the victim’s browser holds, potentially compromising the site’s integrity and the user’s session.