This vulnerability in Joomla! CMS is due to lack of output escaping in feed modules, resulting in a cross-site scripting (CWE-79) vector. It affects multiple versions spanning 3.x and 6.x branches. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, partial user interaction, and high impact on confidentiality and low impact on integrity and availability. No vendor advisory or patch information is available, and no exploits have been observed in the wild.

Successful exploitation could allow an attacker to inject malicious scripts into web pages generated by the feed modules, potentially leading to unauthorized actions in the context of affected users. The impact is rated medium severity based on the CVSS score and vector, with partial user interaction required and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected feed modules to reduce exposure. Monitor Joomla! Project advisories for updates on patches or official mitigations.