The ordasoft.com Book Library (Free) extension for Joomla versions 1.0.0 up to and including 6.4.6 contains a reflected cross-site scripting vulnerability (CWE-79). Specifically, the site/views/view_book/tmpl/default.php template echoes the 'title' request parameter directly into a double-quoted HTML attribute without escaping, allowing an attacker to close the attribute early and inject arbitrary HTML or JavaScript code. This vulnerability has a CVSS 4.0 base score of 5.3, indicating a medium severity risk. No official patch or remediation guidance is provided in the input data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected user's browser session when visiting the vulnerable book-detail page. This may lead to session hijacking, defacement, or other client-side attacks. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should avoid using untrusted input in the 'title' parameter or apply manual input validation and output encoding to prevent injection of malicious code. Consider disabling or restricting access to the vulnerable functionality if possible.