The vulnerability resides in Joomla!'s InputFilter component, where attribute values are normalized but not decoded for HTML5 entities before they are checked against the "javascript:" scheme regex. An attacker can therefore encode a malicious payload using HTML5 entities, evade the filter, and execute arbitrary JavaScript in a victim's browser. This leads to typical XSS consequences such as session hijacking, credential theft, or defacement of the affected website.

Joomla! CMS versions 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3, as well as the Joomla! Framework Filter package covering the same version ranges, are affected by this XSS bypass. All installations running these versions and receiving user input processed through InputFilter are at risk.

The CVSS score of 7.1 indicates a moderately high severity for remote, user‑initiated attacks. No EPSS score is available, so current historical exploitation data is lacking, and the vulnerability is not listed in CISA's KEV catalog. Attackers likely target exposed web interfaces, crafting input that includes encoded characters to bypass the filter. The absence of required credentials suggests ease of exploitation in publicly reachable sites that accept form input or URL parameters.