The Quick Index extension for Joomla versions 1.0.0 through 5.0.4 improperly neutralizes input when generating web pages, specifically by inserting user-configurable class attribute values into HTML without escaping. This allows a privileged user to craft input that closes the intended class attribute and injects new HTML attributes, resulting in stored cross-site scripting (CWE-79). Joomla's content filter is ineffective against this attack vector because the executable HTML is created after filtering. The CVSS 4.0 score is 7.5, indicating high severity with network attack vector, low attack complexity, and partial attack and user interaction requirements.

Successful exploitation allows a privileged user to perform stored XSS attacks by injecting malicious HTML attributes into pages generated by the Quick Index extension. This can lead to execution of arbitrary scripts in the context of users viewing the affected pages, potentially compromising user sessions, data, or performing unauthorized actions. The vulnerability requires privileged access to exploit, limiting exposure to authorized users.

A fix is available in Quick Index version 5.0.5 or later. Users should upgrade to version 5.0.5 or newer to remediate this vulnerability. Until then, restrict privileged user access to trusted individuals and avoid using untrusted input in class attribute configurations. Joomla's content filtering does not mitigate this issue effectively, so upgrading the extension is the recommended action.