This vulnerability involves improper neutralization of input in the HTMLHelper::link method of Joomla! CMS, specifically in versions 1.5.0-5.4.8 and 6.0.0-6.1.3. The lack of proper escaping in this method leads to cross-site scripting (CWE-79) vulnerabilities, which can be exploited to inject malicious scripts into web pages generated by the CMS. The CVSS 4.0 vector indicates network attack vector, low attack complexity, high privileges required, partial user interaction, and high impact on confidentiality and integrity with low impact on availability.

Successful exploitation could allow an attacker with high privileges and requiring partial user interaction to execute arbitrary scripts in the context of the affected Joomla! CMS web pages. This can lead to unauthorized disclosure or modification of information. The vulnerability does not affect service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should exercise caution with input passed to the HTMLHelper::link method and consider applying manual input sanitization or other temporary mitigations as recommended by Joomla! Project advisories.