CyberRota Analysis
AI-GeneratedThe Quick Index extension for Joomla versions prior to 5.0.5 is vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of configurable class values in generated HTML. An attacker can exploit this vulnerability to inject malicious scripts, potentially compromising user sessions or executing unauthorized actions. Joomla administrators and users of the Quick Index extension should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close the intended class attribute and introduce a new attribute. Joomla's content filter cannot reliably prevent this because Quick Index creates the executable HTML after the authored plugin syntax was filtered.