CyberRota Analysis
AI-GeneratedThe Snippets Free and Pro extensions for Joomla prior to specified versions are vulnerable to a privileged stored cross-site scripting (XSS) attack due to inadequate trust level validation for article authors. This flaw allows lower-privileged users to inject malicious scripts into content that can be executed in the context of trusted users, potentially compromising their sessions and data. Joomla administrators and users of the affected extensions should prioritize immediate updates to mitigate this high-severity vulnerability.
Original NVD Description
Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0 - Snippets substitutes variable values supplied by an article tag into saved Snippet content. The affected versions do not consider the article author's trust level. A lower-privileged author can therefore place an unsafe value into a security-sensitive position chosen by the trusted Snippet author.