This vulnerability in Joomla! CMS involves improper neutralization of input during web page generation (CWE-79). Specifically, the generic media output layouts for audio and video in versions 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3 do not properly escape user input, leading to a cross-site scripting (XSS) flaw. This could allow an attacker with high privileges and partial user interaction to execute malicious scripts in the context of other users' browsers. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required for the attacker, partial user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to session hijacking, defacement, or other malicious actions within the Joomla! CMS environment. The impact is rated medium due to the requirement of some user interaction and the need for certain privileges.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Users should monitor Joomla! advisories for updates addressing this vulnerability.