A stored cross-site scripting (XSS) vulnerability exists in the Media Picker component of the Helix Ultimate Joomla extension versions prior to 2.2.11. This vulnerability allows an attacker with low privileges to inject malicious scripts that are stored and later executed in the context of users interacting with the affected component.