This vulnerability in Joomla! CMS versions 4.0.0-5.4.8 and 6.0.0-6.1.3 involves improper neutralization of input during web page generation (CWE-79). Specifically, the link toolbar layout does not properly escape inputs, enabling a cross-site scripting (XSS) vector. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack traceability, partial user interaction, and high impact on confidentiality, integrity, and low impact on availability.

An attacker with high privileges can exploit this vulnerability by tricking a user into interacting with crafted content, potentially leading to execution of arbitrary scripts in the context of the affected Joomla! CMS instance. This could result in unauthorized actions or data exposure within the affected application. However, exploitation requires partial user interaction and high privileges, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the available data, administrators should monitor Joomla! Project advisories for updates. In the meantime, restricting high privilege access and minimizing user interaction with untrusted content may reduce risk.