CVE-2025-54295 MEDIUM

CVE-2025-54295: Extension - dj-extensions.com - Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla

Vendor Dj-Extensions.com
Product DJ-Reviews component for Joomla
Weakness CWE-79 · XSS
Published July 23, 2025
Last update July 24, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered.

Explanation of Vulnerability in Simple Terms

02Summary

The DJ-Reviews component for Joomla contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. An attacker can craft a malicious link or page that, when visited by a site user, executes arbitrary JavaScript in the victim's browser. This can lead to session hijacking, credential theft, or defacement of site content.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in users' browsers when they visit a crafted page or link.

Potential impact on your site

04Site Impact

Site visitors' sessions and credentials can be compromised; site content may be defaced or redirected.

Conditions required to exploit

05Prerequisites

A site user must visit a page or click a link containing the attacker's malicious payload.

Key dates

06Disclosure timeline

July 23, 2025 CVE published
July 24, 2025 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-8351 RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter CVE-2026-57682 WordPress Simple Link Directory plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-27404 WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-57357 WordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-57755 WordPress Mosaic Gallery &#8211; Advanced Gallery plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability