This vulnerability in Joomla! Core’s module list layout occurs because user‑supplied values are not properly escaped. As a result, a malicious actor can cause arbitrary client‑side script execution when the module list page is rendered.

Joomla! CMS versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 are affected by this flaw.

The CVSS score of 5.9 indicates moderate severity, and no EPSS score is available. The flaw is not listed in the CISA KEV catalog, suggesting limited public exploitation. Exploitation would require the attacker to supply a malicious value that is displayed in the module list, and the likely attack vector is remote, requiring only that a victim loads the vulnerable page.