The Event Gallery extension for Joomla processes a base64‑encoded "return" parameter, decodes it, and inserts the result directly into a "Back" link without performing any validation or proper output encoding. This flaw allows an attacker to supply a crafted URL that is rendered as part of the page content, leading to reflected cross‑site scripting (XSS). Moreover, because the user‑controlled value controls the target of the “Back” link, the flaw also enables an open redirect, permitting attackers to lure users to arbitrary external sites.

The vulnerability affects the "Event Gallery" extension developed by svenbluege.de for Joomla, specifically all releases earlier than version 6.5.0.

The assigned CVSS score of 5.3 categorises the flaw as moderate severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to deliver a specially crafted URL containing a base64‑encoded return value to a victim; once the victim clicks the link, the malicious payload is reflected in the browser. This remote attack vector is feasible over the public internet, and the lack of additional user interaction beyond a click makes the threat surface relatively high for exposed Joomla sites.